https://community.splunk.com/t5/Getting-Data-In/how-to-configure-splunk-forwarder-to-monitor-a-file-whose-name/m-p/466657#M80400 <P>Your inputs.conf looks good. The forwarder will notice the new file when it is created and will monitor it. Moving the old file to a new location should not affect the forwarder.</P> Tue, 17 Dec 2019 14:31:46 GMT richgalloway 2019-12-17T14:31:46Z https://community.splunk.com/t5/Getting-Data-In/how-to-configure-splunk-forwarder-to-monitor-a-file-whose-name/m-p/466656#M80399 <P>Hi All,</P> <P>I am trying to monitor a logfile which is generated in a path every day at 23:55 from a python script. My problem here is the file name of the log file changes everyday as the script is appending date to the file name.</P> <P>Eg: Today the file name is "eswitch_16122019_235501_7000.log"<BR /> Tomorrow the file name will be "eswitch_17122019_235501_7000.log"</P> <P>My inputs.conf is as below<BR /> [monitor:///opt/home/splunk_eswitch/eswitch_*.log]<BR /> disabled = false<BR /> index = test2<BR /> sourcetype = eswitch</P> <P>Now when I run splunk list monitor I am seeing a below <BR /> /opt/home/splunk_eswitch/eswitch_*.log<BR /> /opt/delphi/splunk_eswitch/eswitch_16122019_235501_7000.log</P> <P>My question is tomorrow does the forwarder sends the newly created file log to indexer with any issue as the yesterday's file will not be present in the same path.<BR /> Is there any better regex to have in inputs.conf then above one</P> Wed, 30 Sep 2020 03:23:08 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-configure-splunk-forwarder-to-monitor-a-file-whose-name/m-p/466656#M80399 poddraj 2020-09-30T03:23:08Z https://community.splunk.com/t5/Getting-Data-In/how-to-configure-splunk-forwarder-to-monitor-a-file-whose-name/m-p/466657#M80400 <P>Your inputs.conf looks good. The forwarder will notice the new file when it is created and will monitor it. Moving the old file to a new location should not affect the forwarder.</P> Tue, 17 Dec 2019 14:31:46 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-configure-splunk-forwarder-to-monitor-a-file-whose-name/m-p/466657#M80400 richgalloway 2019-12-17T14:31:46Z