topic Re: How do I monitor input on Windows machine with a wild card character? in Getting Data In

How do I monitor input on Windows machine with a wild card character?

santosh_sshanbh — Fri, 28 Sep 2018 13:56:38 GMT

I want to monitor a log file from the below location on a Windows server.

D:\Program Files\Apache Software Foundation\Tomcat 8.5\webapps\config\

However, based on the version of tomcat, the folder name changes. It could be Tomcat 6.0 or Tomcat 7.5 — etc. — on some servers. So, I tried with a different input stanza on the Universal Forwarder in the inputs.conf file.

[monitor://d:\Program Files\Apache Software Foundation\Tomcat*\webapps\config\audit.log]
[monitor://d:\Program Files\Apache Software Foundation\\*\webapps\config\audit.log]
[monitor://d:\Program Files\Apache Software Foundation\\...\webapps\config\audit.log]

None of the above options work and in the Splunkd.log file, I can see the below entry

09-28-2018 13:44:24.422 +0000 INFO  TailingProcessor - Adding watch on path: d:\Program Files\Apache Software Foundation.

which means it is not recognizing folder structure mentioned in input stanza.

Please suggest a solution.

Re: How do I monitor input on Windows machine with a wild card character?

493669 — Fri, 28 Sep 2018 16:24:53 GMT

can you try this: (made D capital)

[monitor://D:\Program Files\Apache Software Foundation\*\webapps\config\audit.log]

Re: How do I monitor input on Windows machine with a wild card character?

JDukeSplunk — Fri, 28 Sep 2018 17:56:56 GMT

We do that very same thing for Tomcat logs since the server team cannot make up their mind where Apache should live.

Java and GC Logs

[monitor:///opt/apache-tomcat/*/GC.log]
disabled = 0
index=application
sourcetype = prod:sun_jvm
ignoreOlderThan = 30d

[monitor:///opt/prpc/prpclogs/*/GC.log]
disabled = 0
index=application
sourcetype = prod:sun_jvm
ignoreOlderThan = 30d

[monitor:///opt/prpc/pegalogs/*/GC.log]
disabled = 0
index=application
sourcetype = prod:sun_jvm
ignoreOlderThan = 30d

[monitor:///opt/prpc/logs/*/GC.log]
disabled = 0
index=application
sourcetype = prod:sun_jvm
ignoreOlderThan = 30d

Re: How do I monitor input on Windows machine with a wild card character?

santosh_sshanbh — Sat, 29 Sep 2018 03:33:44 GMT

Thanks for you inputs. However, in my case the UF is running on Windows OS and your stanza seems to be for Unix based system. I tried multiple options on windows but nothing is working.

Re: How do I monitor input on Windows machine with a wild card character?

santosh_sshanbh — Sat, 29 Sep 2018 03:50:42 GMT

Tried the same with D in caps but no success. Splunkd log still shows below

Adding watch on path: D:\Program Files\Apache Software Foundation

It seems that it is not recognizing rest of the path in monitor stanza.