topic Cannot search log that is configured on forwarder using wildcard in Splunk Search

Cannot search log that is configured on forwarder using wildcard

Isaias_Garcia — Mon, 28 Sep 2020 18:57:50 GMT

I configured my forwarder as :

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]
disabled = false
followTail = 0
host = sumosamprd76
index = prd
sourcetype = sumologs

But why is it I cannot search the logs under "logger/simlog.log" logfile when I ran the below query? Is there something wrong in configuring forwarder with wild card (i.e asterisk)?

source=/sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/logger/simlog.log

Please help. thanks

Re: Cannot search log that is configured on forwarder using wildcard

HiroshiSatoh — Mon, 16 Feb 2015 05:12:53 GMT

monitor is specified.

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]

↓

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/*.log]

(EX.)
To monitor any file directly under /apache/ that ends in .log:
[monitor:///apache/*.log]

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards

Be considered as a reason you can not search
1. Has not been taken up log
2. INDEX of interest is not the default search
→ Please add "index = prd" in the search condition.
3. Is wrong specified SOURCE

Re: Cannot search log that is configured on forwarder using wildcard

Isaias_Garcia — Wed, 18 Feb 2015 05:45:14 GMT

cheers! thanks