topic Re: How To monitor data for specific months. in Getting Data In

How To monitor data for specific months.

isha_rastogi — Wed, 19 Apr 2017 11:12:26 GMT

I've logs files in the location which has dates like:
/test/01-10-2016/test.log
/test/01-11-2016/test.log

I have to monitor files from October to Feb . Can I write single monitor statement rather than writing separately for all 5 months.

[monitor:////test/01-10-2016/test.log]
index=test

Re: How To monitor data for specific months.

adonio — Wed, 19 Apr 2017 12:44:50 GMT

you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input_examples
hope it helps

Re: How To monitor data for specific months.

isha_rastogi — Wed, 19 Apr 2017 12:57:51 GMT

Can I do it in one monitor statement?

Re: How To monitor data for specific months.

adonio — Wed, 19 Apr 2017 13:03:42 GMT

if you have logs from March and April 17 you will probably need 3 although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:
[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

Re: How To monitor data for specific months.

isha_rastogi — Wed, 19 Apr 2017 13:19:56 GMT

Ok. Thanks 🙂

Re: How To monitor data for specific months.

adonio — Wed, 19 Apr 2017 13:31:44 GMT

Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input_examples
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:

[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype