topic Re: Monitor doesn't work with the path including a space character in Getting Data In

Monitor doesn't work with the path including a space character

hi_sekine — Mon, 28 Sep 2020 12:10:21 GMT

Is there any workaround ?

I have logs that path beginning with space character. But Splunk doesn't detect them.

Sample files:
Log\20120711\ 0313139\Name54detail.log
Log\20120711\ 1281020\Name55detail.log

inputs.conf:
[monitor://E:\user05...Nam*[Dd]etai*.[Ll][Oo][Gg]]

Re: Monitor doesn't work with the path including a space character

Takajian — Tue, 31 Jul 2012 06:05:43 GMT

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

Re: Monitor doesn't work with the path including a space character

hi_sekine — Wed, 01 Aug 2012 01:47:48 GMT

Thank you for your help, Mr. Takjian.

I'd been confused about "source" display of splunk.
I wondered "source" was less than monitor files.

But the monitor files had duplicated contents. Same lines were recorded on files in different directories.
Then the "source" was less than monitor files.

It seems that there is no lack of file contents.

I'm sorry about my confusion.