topic Re: monitoring recursive directories , with only one line in Getting Data In

monitoring recursive directories , with only one line

robertlynch2020 — Tue, 29 Sep 2020 13:34:58 GMT

I have a directory

/net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3

However it looks like i have to add two lines into my forwarder to do monitor the original directory and all the sub-directories, is there one line that i can use?

[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3/*.log]
disabled = false
recursive = true
host = MXTIMING_LIVE_TEST2
index = mlc_live
whitelist = mxtiming_(?<ppp>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3/.../*.log]
disabled = false
recursive = true
host = MXTIMING_LIVE_TEST2
index = mlc_live
whitelist = mxtiming_(?<ppp>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

Re: monitoring recursive directories , with only one line

DalJeanis — Fri, 07 Apr 2017 16:49:44 GMT

Apparently the other document is wrong, and the parent directory is NOT covered by the /.../ construct, so this is the correct answer.

Try this -

[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3.../*.log]

The documentation states that ... indicates recursion through subdirectories, which implies that the slashes on either side of it are not required features of the ... itself. No examples of that usage are in the documentation, however.

If that doesn't work, then you can use the regular expression equivalent...

[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3.*/*.log]

It's not very splunky, but it's a valid regex and matches the "Regular Expression Equivalent for ..." given in the table here -
https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards

Re: monitoring recursive directories , with only one line

masonmorales — Fri, 07 Apr 2017 23:49:54 GMT

This should work:

 [monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3]
 disabled = false
 recursive = true
 host = MXTIMING_LIVE_TEST2
 index = mlc_live
 whitelist = mxtiming_(?<ppp>\d*_[^_]*_\d*)\.log
 crcSalt = <SOURCE>
 sourcetype = MX_TIMING

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

BTW, recursive defaults to true, so you don't actually need to specify "recursive = true" in your config.

Re: monitoring recursive directories , with only one line

DalJeanis — Sat, 08 Apr 2017 00:14:08 GMT

Very curious.

https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards specifically says that ...

/foo/.../bar.log matches the files /foo/1/bar.log, /foo/2/bar.log, /foo/1/2/bar.log, etc., but does not match /foo/bar.log, or /foo/3/notbar.log
Because a single ellipse recurses through all folders and subfolders, /foo/.../bar.log matches the same as /foo/.../.../bar.log.

Your doc is specifically regarding wildcards and monitor:, so the more specific beats the more general. Upvoting yours and putting a caveat on mine.

Re: monitoring recursive directories , with only one line

woodcock — Sat, 08 Apr 2017 18:10:41 GMT

When you reference a person, if you prefix with @ (as in @woodcock), the system will notify the person that you mentioned him.

Re: monitoring recursive directories , with only one line

robertlynch2020 — Tue, 29 Sep 2020 13:39:17 GMT

in fact it does not work
[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3/.../.log]
i had to use
[monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3.../.log]
to get it to work correctly.

Re: monitoring recursive directories , with only one line

robertlynch2020 — Thu, 13 Apr 2017 14:46:57 GMT

Cheers - this is what i needed 🙂

Re: monitoring recursive directories , with only one line

DalJeanis — Thu, 13 Apr 2017 15:29:31 GMT

@woodcock - thanks!