All Apps and Add-ons

Begin monitoring files in a folder which is created every day With diff name.

krish3
Contributor

Hi,

I have a situation where the logs files are created along with a date ex: error.log_2014-02-16. I need to monitor these logs continuously. Each day there is a new file created in the folder how cam i do this on my forwarder.

And i need them to be indexed from present time or date since i don't need spending my license indexing old data.

0 Karma
1 Solution

Ayn
Legend

Just monitor the whole directory, and use the ignoreOlderThan directive in inputs.conf.

Something like this:

[monitor:///your/monitored/directory]
disabled = 0
ignoreOlderThan = 1d

This assumes you know that your forwarder will not be offline for longer periods of time though - if it is, be aware of that setting ignoreOlderThan to 1d will cause it to ignore files older than that when it checks which files it should read events from.

View solution in original post

0 Karma

Ayn
Legend

Just monitor the whole directory, and use the ignoreOlderThan directive in inputs.conf.

Something like this:

[monitor:///your/monitored/directory]
disabled = 0
ignoreOlderThan = 1d

This assumes you know that your forwarder will not be offline for longer periods of time though - if it is, be aware of that setting ignoreOlderThan to 1d will cause it to ignore files older than that when it checks which files it should read events from.

0 Karma

laserval
Communicator

You could also set a whitelist with a regular expression to filter so you only get files that follow the format you have. That way you don't get any nasty surprises if someone puts other files in there.

0 Karma

krish3
Contributor

thanks....

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...