topic Re: inputs.conf + wildcard not picking up anything in Getting Data In

inputs.conf + wildcard not picking up anything

virtualpony — Tue, 27 Nov 2012 00:06:07 GMT

I am trying to monitor a log file where the directory path may change from one machine to another. But these rules are for sure:

The first folder has the word hyperic
The second folder has the word agent in it
the third folder is named logs
the file to be read is named agent.log

Some admins have named the first directory hyperic ... some have named it something else like hyperic 4.6.6

Also the second folder might be named hyperic-hqee-agent-4.6.5 or hyperic-hqee-agent-4.6.6 ... but we know that it has agent in it, so we want to proceed down to the next level.

A full path might look like this:

C:\Hyperic\hyperic-hqee-agent-4.6.6\log\agent.log

My inputs.conf has this stanza in it:

[monitor://C:\*Hyperic*\*agent*\log\agent.log]
disabled = false
sourcetype = hyperic_agent

the apps have deployed to all the corresponding machines, but nothing is being received. This is what I see in the splunkd logs:

11-26-2012 14:57:54.686 -0800 INFO  TailingProcessor - Parsing configuration stanza: monitor://C:\*Hyperic*\*agent*\log\agent.log.

Re: inputs.conf + wildcard not picking up anything

lguinn2 — Tue, 27 Nov 2012 01:03:10 GMT

On any of the machines, what do you see when you run

splunk list monitor

Re: inputs.conf + wildcard not picking up anything

virtualpony — Tue, 27 Nov 2012 01:13:49 GMT

There are quite a bit of files monitored, but I think what you wanted to see was if the file in question is being monitored. It is listed as following:
C:\*Hyperic*\*agent*\log\agent.log C:\*Hyperic*\*agent*\log\wrapper.log

Re: inputs.conf + wildcard not picking up anything

lguinn2 — Tue, 27 Nov 2012 01:25:31 GMT

Try this:

[monitor://C:\\*Hyperic*\\*agent*\\log\\agent.log]

I think Splunk is seeing the single backslashes as escaping the following character.

Re: inputs.conf + wildcard not picking up anything

virtualpony — Tue, 27 Nov 2012 16:35:43 GMT

I tried that but it doesn't work either. Thanks.

Re: inputs.conf + wildcard not picking up anything

sowings — Tue, 27 Nov 2012 16:46:50 GMT

Try without the leading star after C:\.

[monitor://C:\\Hyperic*\\*agent*\\log\\agent.log

Re: inputs.conf + wildcard not picking up anything

virtualpony — Tue, 27 Nov 2012 17:39:35 GMT

I have tried that also, still nothing. I get a TailingProcessor error event when I use double slashes \\. That error isn't present with single slashes.