Getting Data In

Are inputs.conf attribute values case sensitive?

Madhan45
Path Finder

[monitor:///tmp/ABC.txt] is my monitor stanza.

But if i have the file welcomeabcdef.txt that is "abc" (lowercase instead of uppercase) will it be read and indexed by Splunk?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.

Bye.
Giuseppe

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey Madhan45, if they
solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.

Bye.
Giuseppe

Madhan45
Path Finder

Thanks for response Giuseppe.

so you meant to say "(astric)ABC(actric).txt", will not capture "welcomeabcde.txt" file in unix?

Is my understanding is correct?

0 Karma

gcusello
SplunkTrust
SplunkTrust

yes,
you can test it in linux with the command

ls -al /your_path/*ABC*.txt

Anyway, you have to create two stanzas in inputs.conf.

Bye.
Giuseppe

0 Karma

Madhan45
Path Finder

Ok thanks.

0 Karma

gcusello
SplunkTrust
SplunkTrust

if, this solution satisfies your question,please accept or upvote it.
Bye.
giuseppe

Madhan45
Path Finder

Setting:
[monitor:///tmp/ABC.txt]

File name :
welcomeabcdef.txt

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...