topic Re: wildcard not working in inputs.conf in Getting Data In

wildcard not working in inputs.conf

a212830 — Wed, 05 Mar 2014 13:54:22 GMT

Hi,

I need to monitor a single file that exists in multiple directories, which can change without my notice, but will follow the same format. I tried setting up a wildcard, but it's not working.

The directory structure is:

/pwstcdwlk*/log/*/gpws_error.log

The filename is always gpws_error.log, and the filesystem will always begin with /pwstcdwlk, but the segment after log can change and be almost anything.

I had the following, but it did not work.

[monitor:///pwstcdwlk*/log/.../gpws_error.log]
recursive = yes
disabled = false
followTail = false
sourcetype  = log4j
index =  throwaway

Re: wildcard not working in inputs.conf

theouhuios — Wed, 05 Mar 2014 14:23:21 GMT

You mentioned a specific directory structure. Do you have multiple directory structures like that?

try [monitor:///.../log/.../gpws_error.log]

... -> is a recursive wildcard. What you have as of now should also work if there is something like pwstcdwlkABC,pwstcdwlk123 etc.

Re: wildcard not working in inputs.conf

a212830 — Wed, 05 Mar 2014 14:44:06 GMT

The ones that I want all begin with pwstcdwlk, but it can change after that - could be a 1, could be abc... - out of my control. I don't want to make it wide open, as other files could be grabbed.

Re: wildcard not working in inputs.conf

theouhuios — Wed, 05 Mar 2014 15:54:49 GMT

Do you see any error in the logs. If thats the case then your stanza looks right to me. There is no data being indexed from the log file? How many lines does the log file have?

Re: wildcard not working in inputs.conf

a212830 — Mon, 28 Sep 2020 16:03:32 GMT

Lots of data available, with multiple logs. The splunkd.log isn't showing any errors - just this message: 03-06-2014 08:02:58.235 -0500 INFO TailingProcessor - Parsing configuration stanza: monitor:///pws*/log/.../gpws_error.log.

Here's some sampleoutput of an ls command:

-rw-rw-r-- 1 blahblah blahblah 165 Mar 5 08:15 /pwstcawlk3/log/PROCESSMONITOR/gpws_error.log
-rw-rw-r-- 1 blahblah blahblah 180874 Mar 5 10:22 /pwstcawlk2/log/HTTPCONTROLLERARCH/gpws_error.log

Those files (and others) are not being indexed. BTW - this is on AIX, if that matters.

Re: wildcard not working in inputs.conf

a212830 — Thu, 06 Mar 2014 16:06:34 GMT

Looks like a bug in 5.01 - upgraded to 5.04, and everything worked.

Re: wildcard not working in inputs.conf

the_wolverine — Wed, 16 Apr 2014 19:06:46 GMT

FWIW, I also encountered this in 4.3.3.3 -- not sure if any other versions affected.

[monitor:///*dir*/logs/*/*.log]

Did not work properly. Something about the wildcard at the base directory.

I had to use

[monitor:///actualdirname/logs/*/*.log]