Can splunk forwarders be configured to find log files under a specified dir using a wildcard name like *.log for example?

[ahughf]

Sorry if this is answered somewhere in the documentation (I couldn't find it after a fairly cursory glance).
We have various unix daemon processes that all have current dir’s under a specific node in the directory structure. They all share a similar naming convention. I was wondering if it is possible to configure a forwarder to ‘discover’ new log files for any new processes we add?
If this is possible, does it require that the forwarder be bounced?

I suppose this would be possible via the CLI as we deploy the new process as part of it's deployment script.

Thanks Hugh

[MuS]

Hi ahughf

yes, sure you can do this. Take a look at http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Specifyinputpathswithwildcards for some monitor examples using wildcards. Further you can use white- and/or blacklist to have only *.log indexed.

And another yes, you can use CLI to add monitors find examples here

hope this helps

cheers,

MuS

[martin_mueller]

Yes.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Specifyinputpathswithwildcards

[MuS]

dammit, you were 14 seconds faster 🙂