topic Windows Monitoring Stanza help in Getting Data In

Windows Monitoring Stanza help

vrmandadi — Tue, 24 Nov 2020 06:54:54 GMT

Hello I have the below location to be monitored in a windows machine

D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\abclog.2019-02-17

D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\abclog.2019-02-17

This is the monitoring stanza I am assuming is correct which will take all folders log files like appzookeeper,backgrounder,terniation etc

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs.*]

Thanks in advance

Re: Windows Monitoring Stanza help

richgalloway — Thu, 21 Feb 2019 16:58:47 GMT

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]

Re: Windows Monitoring Stanza help

vrmandadi — Mon, 25 Feb 2019 19:48:43 GMT

Thank You!

Re: Windows Monitoring Stanza help

sahilverma — Mon, 23 Nov 2020 23:04:28 GMT

Hello Guys, I am new to splunk and need your help. I am also looking for same file monitoring to splunk cloud using splunk heavy forwarder. Can you tell what values did u used in input.conf ? or if you required to use regex to change some sort of transformation for getting into splunk.