Add monitor for filename with wildcard

[thematthewgreen]

I wanted to add a monitor for a file using an wildcard as part of the name as the file name will change daily. I added the following monitor:

file name = myfile.log-2011-11-04
splunk add monitor myfile.log-*

This resulted in a monitored log file for myfile.log-2011-11-04 which is fine for the current file but I want the next file myfile.log-2011-11-05 to be automatically monitored as well.

Will this be the case? I didn't see any examples in the documentation for adding a wildcard for a file, only directory paths.

[tgow · Accepted solution]

You can use the following syntax in your inputs.conf:

[monitor::...myfile.log...]

Here is information from the manual:

Note concerning wildcards and monitor:

• You can use wildcards to specify your input path for monitored input. Use "..." for recursive directory matching and "*" for wildcard matching in a single directory segment.
• "..." recurses through directories. This means that /foo/.../bar will match foo/bar, foo/1/bar, foo/1/2/bar, etc.
• You can use multiple "..." specifications in a single input path. For example: /foo/.../bar/...
• The asterisk () matches anything in a single path segment; unlike "...", it does not recurse. For example, /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc. However, it does not match /foo/1/2/bar . A second example: /foo/m*r/bar matches /foo/bar, /foo/mr/bar, /foo/mir/bar, /foo/moor/bar, etc.
• You can combine "" and "..." as required: foo/.../bar/ matches any file in the bar directory within the specified path.