topic Re: How to continuously monitor a file from a shared folder or path? in Getting Data In

How to continuously monitor a file from a shared folder or path?

Shan — Sun, 05 Aug 2018 05:23:13 GMT

Hai All,

Please help me out to understand. how to continuously monitor a file from a shared folder or path?

Thanks in advance..

Re: How to continuously monitor a file from a shared folder or path?

renjith_nair — Sun, 05 Aug 2018 05:30:04 GMT

Its same as splunk file monitors if you are including the absolute path
Ref : https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Monitorfilesanddirectorieswithinputs.conf
Are you facing any issues?

Re: How to continuously monitor a file from a shared folder or path?

Shan — Mon, 06 Aug 2018 11:57:01 GMT

@renjith.nair

I haven't tried it yet.. Just wanna get some idea about how to do it . So i posted a question.

Re: How to continuously monitor a file from a shared folder or path?

renjith_nair — Mon, 06 Aug 2018 12:26:39 GMT

Suggest you to try that first and let the community know if you have any issues.

Re: How to continuously monitor a file from a shared folder or path?

Shan — Mon, 06 Aug 2018 14:00:57 GMT

@renjith.nair,

No issues.. I'm about to try that one. :-)..

Thanks

Re: How to continuously monitor a file from a shared folder or path?

ssadanala1 — Mon, 06 Aug 2018 20:44:20 GMT

Per documentation

[monitor://]
* This directs a file monitor input to watch all files in .
* can be an entire directory or a single file.
* You must specify the input type and then the path, so put three slashes in
your path if you are starting at the root on *nix systems (to include the
slash that indicates an absolute path).

Re: How to continuously monitor a file from a shared folder or path?

adonio — Tue, 07 Aug 2018 03:21:31 GMT

in inputs.conf, add [monitor:///full/path/to/file]
you can also use wildcards to constantly monitor many files:
[monitor:///full/path/to/*.log]
here all the files that ends with .log
read all documentation here:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Monitorfilesanddirectorieswithinputs.conf

hope it hepls