Getting Data In

Are inputs.conf attribute values case sensitive?

Madhan45
Path Finder

[monitor:///tmp/ABC.txt] is my monitor stanza.

But if i have the file welcomeabcdef.txt that is "abc" (lowercase instead of uppercase) will it be read and indexed by Splunk?

0 Karma
1 Solution

gcusello
Legend

Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.

Bye.
Giuseppe

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey Madhan45, if they
solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

gcusello
Legend

Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.

Bye.
Giuseppe

Madhan45
Path Finder

Thanks for response Giuseppe.

so you meant to say "(astric)ABC(actric).txt", will not capture "welcomeabcde.txt" file in unix?

Is my understanding is correct?

0 Karma

gcusello
Legend

yes,
you can test it in linux with the command

ls -al /your_path/*ABC*.txt

Anyway, you have to create two stanzas in inputs.conf.

Bye.
Giuseppe

0 Karma

Madhan45
Path Finder

Ok thanks.

0 Karma

gcusello
Legend

if, this solution satisfies your question,please accept or upvote it.
Bye.
giuseppe

Madhan45
Path Finder

Setting:
[monitor:///tmp/ABC.txt]

File name :
welcomeabcdef.txt

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...