https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215116#M42348 <P>HI ,<BR /> I have below log files in the /repo/logs directory. </P> <PRE><CODE>http_access_management_console_2016-04-25.log http_access_management_console_2016-04-26.log http_access_management_console_2016-04-27.log http_access_management_console_2016-04-28.log http_access_management_console_2016-04-29.log carbon.log carbon.log.2016-04-27 carbon.log.2016-04-28 carbon.log.2016-04-29 </CODE></PRE> <P>http_access_management logs were recorded with dates for each day, where as carbon.log is today's log, and old dated logs are older logs.</P> <P>to monitor http_access logs i am using the below command </P> <PRE><CODE>./splunk add monitor /repository/logs/http_acce*.log -index hello -sourcetype esb-http-access-logs </CODE></PRE> <P>and its throwing me the error <BR /> Parameters must be in the form <CODE>-parameter value</CODE></P> <P>and for carbon logs to monitor i am using the command</P> <PRE><CODE>./splunk add monitor /repository/logs/wso2carbon.* -index hello -sourcetype esb-carbon-logs </CODE></PRE> <P>and its also throwing me same issue.</P> <PRE><CODE>Parameters must be in the form '-parameter value' </CODE></PRE> <P>Was trying couple of different formats, nothing was working. Can someone help me on this?</P> Tue, 29 Sep 2020 11:10:29 GMT murthychitturi 2020-09-29T11:10:29Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215116#M42348 <P>HI ,<BR /> I have below log files in the /repo/logs directory. </P> <PRE><CODE>http_access_management_console_2016-04-25.log http_access_management_console_2016-04-26.log http_access_management_console_2016-04-27.log http_access_management_console_2016-04-28.log http_access_management_console_2016-04-29.log carbon.log carbon.log.2016-04-27 carbon.log.2016-04-28 carbon.log.2016-04-29 </CODE></PRE> <P>http_access_management logs were recorded with dates for each day, where as carbon.log is today's log, and old dated logs are older logs.</P> <P>to monitor http_access logs i am using the below command </P> <PRE><CODE>./splunk add monitor /repository/logs/http_acce*.log -index hello -sourcetype esb-http-access-logs </CODE></PRE> <P>and its throwing me the error <BR /> Parameters must be in the form <CODE>-parameter value</CODE></P> <P>and for carbon logs to monitor i am using the command</P> <PRE><CODE>./splunk add monitor /repository/logs/wso2carbon.* -index hello -sourcetype esb-carbon-logs </CODE></PRE> <P>and its also throwing me same issue.</P> <PRE><CODE>Parameters must be in the form '-parameter value' </CODE></PRE> <P>Was trying couple of different formats, nothing was working. Can someone help me on this?</P> Tue, 29 Sep 2020 11:10:29 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215116#M42348 murthychitturi 2020-09-29T11:10:29Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215117#M42349 <P>Did you try to quote the path like this:</P> <PRE><CODE> ./splunk add monitor '/repository/logs/http_acce*.log' -index hello -sourcetype esc-http-access-logs </CODE></PRE> <P>cheers, MuS</P> Tue, 27 Sep 2016 22:27:59 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215117#M42349 MuS 2016-09-27T22:27:59Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215118#M42350 <P>Thanks that worked for me. What is the command that will be used for me to monitor only the files for past 3 days and ignore the file before 3days. I used ignoreOlderThan = 3d , but still i can see the previous files in my splunk server.</P> Wed, 28 Sep 2016 18:48:29 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215118#M42350 murthychitturi 2016-09-28T18:48:29Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215119#M42351 <P>Well, once indexed by splunk you will find these file until they age out of the index. The option <CODE>ignoreOlderThan</CODE> will work if you disable the monitor for 4 days and enable it again. After that you will only have the new data from the last three days, based on the modification date of the log file.</P> <P>cheers, MuS</P> Wed, 28 Sep 2016 23:54:16 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-regular-expression-in-inputs-conf-not-working-to/m-p/215119#M42351 MuS 2016-09-28T23:54:16Z