topic Re: Help with input monitoring in Getting Data In

Help with input monitoring

a212830 — Thu, 22 Jan 2015 12:57:32 GMT

Hi,

I need to monitor some logs where I need to wildcard part of the hostname into the path. Is that possible:

For example, I have:

/apps/oracle/install/admin/instances
/apps/oracle/install/admin/instances/ovdpmmk1a
/apps/oracle/install/admin/instances/ovdpmmk1b
/apps/oracle/install/admin/instances/ovdpmmk2a
/apps/oracle/install/admin/instances/ovdpmmk2b
/apps/oracle/install/admin/instances/ovdpmmk3a
/apps/oracle/install/admin/instances/ovdpmmk3b... (it keeps going)

The hostname is ovdpmmk1. On this server, I want to monitor certain files in the ovdpmmk1a and 1b directories. On the ovdpmmk2 server, I want to monitor certain files in the ovdpmmk2a and 2b directory. Is there a way to take the hostname and make it part of the inputs?

So monitor:.../apps/oracle/install/admin/instances/REGEXFORHOSTNAME/myfile?

Re: Help with input monitoring

pmdba — Thu, 22 Jan 2015 21:39:23 GMT

You can use wildcards in the path. E.g. /apps/oracle/install/admin/instances/*/myfile

For a look at a variety of input types, including this one, check out Log File Analysis for Oracle 11g on the apps.splunk.com web site.

Re: Help with input monitoring

a212830 — Thu, 22 Jan 2015 22:15:19 GMT

I don't think wildcards will work in this case, if I want to use only one input. Looking for hostname variable or something like that...

Re: Help with input monitoring

a212830 — Fri, 23 Jan 2015 01:05:00 GMT

Does this still apply? Pretty old...seems like a similar situation.

http://blogs.splunk.com/2009/07/09/monitoring-input-files-with-a-white-list/

Re: Help with input monitoring

pmdba — Fri, 23 Jan 2015 21:11:36 GMT

I use wildcards for similar situations. For instance, I pick up alert log files for Oracle with something like this:

monitor:///apps/oracle/diag/rdbms/*/*/trace/alert*.log

This picks up all alert logs on the system for every database, including any that I might add in the future, with one input. In your case I would think something like this would work:

/apps/oracle/install/admin/instances/ovdpmmk*

Re: Help with input monitoring

a212830 — Sat, 24 Jan 2015 04:14:32 GMT

That won't work because there are 4 directories of ovdpmmk on each server, and I only want the one that matches the hostname. So, if the hostname is ovdpmmk1, I want that one, if it's ovdpmmk2, I want ovdpmmk2....

Re: Help with input monitoring

pmdba — Sat, 24 Jan 2015 22:58:36 GMT

I begin to see the difficulty. I haven't tried this - perhaps you have already - but would something like this work?

 /apps/oracle/install/admin/instances/${hostname}*

You just need a common environment variable that returns the hostname...

Re: Help with input monitoring

a212830 — Sun, 25 Jan 2015 14:48:11 GMT

That's what I'm looking for... I'll try it. Wasn't sure which variables that are allowed in stanza's....