https://community.splunk.com/t5/Getting-Data-In/splunk-uf-not-reading-logs/m-p/523978#M88486 <P><SPAN>hello</SPAN><SPAN>we’ve directory structure as follows</SPAN><BR /><SPAN>/apps/ftp/user/logs/admin -- main directory</SPAN><BR /><SPAN>sub-directories</SPAN><BR /><SPAN>2018 2019 2020</SPAN><BR /><SPAN>and further more each sub-directory with year has directories with months as</SPAN><BR /><SPAN>01 02 02 03 04 05 06 07 08 09 10</SPAN><BR /><SPAN>under months directories we have csv log files</SPAN><SPAN>so to access a csv file for today</SPAN><BR /><SPAN>/apps/ftp/user/logs/admin/2020/10/20201008.csv</SPAN><SPAN>here is monitor stanza for to read this file</SPAN><BR /><SPAN>[monitor:///apps/*/user/logs/admin/.../.../*.csv]</SPAN><BR /><SPAN>disabled = false</SPAN><BR /><SPAN>sourcetype = csv</SPAN><BR /><SPAN>index= user-access-logs</SPAN><BR /><SPAN>crcSalt = &lt;SOURCE&gt;</SPAN><SPAN>but it’s not reading logs and no error in splunkd logs. can someone help me in correcting the monitor stanza if i’ve done mistake</SPAN></P> Fri, 09 Oct 2020 18:39:58 GMT AzmathShaik 2020-10-09T18:39:58Z https://community.splunk.com/t5/Getting-Data-In/splunk-uf-not-reading-logs/m-p/523978#M88486 <P><SPAN>hello</SPAN><SPAN>we’ve directory structure as follows</SPAN><BR /><SPAN>/apps/ftp/user/logs/admin -- main directory</SPAN><BR /><SPAN>sub-directories</SPAN><BR /><SPAN>2018 2019 2020</SPAN><BR /><SPAN>and further more each sub-directory with year has directories with months as</SPAN><BR /><SPAN>01 02 02 03 04 05 06 07 08 09 10</SPAN><BR /><SPAN>under months directories we have csv log files</SPAN><SPAN>so to access a csv file for today</SPAN><BR /><SPAN>/apps/ftp/user/logs/admin/2020/10/20201008.csv</SPAN><SPAN>here is monitor stanza for to read this file</SPAN><BR /><SPAN>[monitor:///apps/*/user/logs/admin/.../.../*.csv]</SPAN><BR /><SPAN>disabled = false</SPAN><BR /><SPAN>sourcetype = csv</SPAN><BR /><SPAN>index= user-access-logs</SPAN><BR /><SPAN>crcSalt = &lt;SOURCE&gt;</SPAN><SPAN>but it’s not reading logs and no error in splunkd logs. can someone help me in correcting the monitor stanza if i’ve done mistake</SPAN></P> Fri, 09 Oct 2020 18:39:58 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-uf-not-reading-logs/m-p/523978#M88486 AzmathShaik 2020-10-09T18:39:58Z https://community.splunk.com/t5/Getting-Data-In/splunk-uf-not-reading-logs/m-p/524019#M88494 Can you try to replace .../... with ... as ... means any number of subdirectories. Other option is replace it with */*<BR />r. Ismo Sat, 10 Oct 2020 06:55:34 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-uf-not-reading-logs/m-p/524019#M88494 isoutamo 2020-10-10T06:55:34Z