https://community.splunk.com/t5/Monitoring-Splunk/Monitor-multi-directory-and-using-whitelisting/m-p/65812#M7180 <PRE><CODE>[monitor:///var/www/vhosts/*/statistics/logs/access_log] sourcetype=access_common [monitor:///var/www/vhosts/*/statistics/logs/error_log] sourcetype=apache_error </CODE></PRE> <P>would do it.</P> Wed, 23 Mar 2011 08:57:16 GMT gkanapathy 2011-03-23T08:57:16Z https://community.splunk.com/t5/Monitoring-Splunk/Monitor-multi-directory-and-using-whitelisting/m-p/65811#M7179 <P>I have to monitorize multiple log such access_log, error_log and xferlog_regular files in a different categories. The structure more or less would look like (example with 2 log files):</P> <PRE><CODE>/var/www/vhosts/site1/statistics/logs/access_log /var/www/vhosts/site1/statistics/logs/error_log /var/www/vhosts/site2/statistics/logs/access_log /var/www/vhosts/site2/statistics/logs/error_log /var/www/vhosts/site3/statistics/logs/access_log /var/www/vhosts/site3/statistics/logs/error_log /var/www/vhosts/site4/statistics/logs/access_log /var/www/vhosts/site5/statistics/logs/error_log </CODE></PRE> <P>obviously site1 one can be for example mycustomerstiename.com and site2 can be google.com…, so every sitename its different. So, which regex i have to use to get all that logs ? Thanks</P> Wed, 23 Mar 2011 08:27:08 GMT https://community.splunk.com/t5/Monitoring-Splunk/Monitor-multi-directory-and-using-whitelisting/m-p/65811#M7179 roccotocco 2011-03-23T08:27:08Z https://community.splunk.com/t5/Monitoring-Splunk/Monitor-multi-directory-and-using-whitelisting/m-p/65812#M7180 <PRE><CODE>[monitor:///var/www/vhosts/*/statistics/logs/access_log] sourcetype=access_common [monitor:///var/www/vhosts/*/statistics/logs/error_log] sourcetype=apache_error </CODE></PRE> <P>would do it.</P> Wed, 23 Mar 2011 08:57:16 GMT https://community.splunk.com/t5/Monitoring-Splunk/Monitor-multi-directory-and-using-whitelisting/m-p/65812#M7180 gkanapathy 2011-03-23T08:57:16Z