Getting Data In

Can splunk forwarders be configured to find log files under a specified dir using a wildcard name like *.log for example?

ahughf
Engager

Sorry if this is answered somewhere in the documentation (I couldn't find it after a fairly cursory glance).
We have various unix daemon processes that all have current dir’s under a specific node in the directory structure. They all share a similar naming convention. I was wondering if it is possible to configure a forwarder to ‘discover’ new log files for any new processes we add?
If this is possible, does it require that the forwarder be bounced?

I suppose this would be possible via the CLI as we deploy the new process as part of it's deployment script.

Thanks Hugh

Tags (1)

MuS
Legend

Hi ahughf

yes, sure you can do this. Take a look at http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Specifyinputpathswithwildcards for some monitor examples using wildcards. Further you can use white- and/or blacklist to have only *.log indexed.

And another yes, you can use CLI to add monitors find examples here

hope this helps

cheers,

MuS

MuS
Legend

dammit, you were 14 seconds faster :slightly_smiling_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...