Getting Data In

Adding a directory with variables

markthompson
Builder

Hi,
I'm trying to index a directory, that has subdirectories in this format:

-Directory
        ---Sub Directory
                 -----Logs
        ---Sub Directory
                 -----Logs
        ---Sub Directory
                 -----Logs

Like the above, and basically I want to add 1 data input, which would look something like /directory/.../logs so the ... can be any of the sub directory names. Please can somebody help with some syntax on how to do this.

I look forward to your response.

Thanks

Tags (3)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi markthompson,

that's exactly what you need to do, create a monitor stanza in inputs.conf (or in the UI, data inputs) that looks likt this:

 [monitor://directory/.../Logs/*]

see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Specifyinputpathswithwildcards

hope that helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi markthompson,

that's exactly what you need to do, create a monitor stanza in inputs.conf (or in the UI, data inputs) that looks likt this:

 [monitor://directory/.../Logs/*]

see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Specifyinputpathswithwildcards

hope that helps ...

cheers, MuS

markthompson
Builder

Hey MuS, can you tell me the path for the inputs.conf please. splunk -> etc?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi, you would do that on the directory source server and in etc/system/local/inputs.conf for example

0 Karma

pmdba
Builder

You can use wildcards in the directory path. I often use something like this:

[monitor:///export/oracle/diag/rdbms/*/*/trace/alert*.log]

to pick up logs for all of my databases with a single monitor.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...