Getting Data In

Are inputs.conf attribute values case sensitive?

Madhan45
Path Finder

[monitor:///tmp/ABC.txt] is my monitor stanza.

But if i have the file welcomeabcdef.txt that is "abc" (lowercase instead of uppercase) will it be read and indexed by Splunk?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.

Bye.
Giuseppe

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey Madhan45, if they
solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.

Bye.
Giuseppe

Madhan45
Path Finder

Thanks for response Giuseppe.

so you meant to say "(astric)ABC(actric).txt", will not capture "welcomeabcde.txt" file in unix?

Is my understanding is correct?

0 Karma

gcusello
SplunkTrust
SplunkTrust

yes,
you can test it in linux with the command

ls -al /your_path/*ABC*.txt

Anyway, you have to create two stanzas in inputs.conf.

Bye.
Giuseppe

0 Karma

Madhan45
Path Finder

Ok thanks.

0 Karma

gcusello
SplunkTrust
SplunkTrust

if, this solution satisfies your question,please accept or upvote it.
Bye.
giuseppe

Madhan45
Path Finder

Setting:
[monitor:///tmp/ABC.txt]

File name :
welcomeabcdef.txt

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...