Getting Data In

Can we use OR condition in monitoring stanza

Naga
Engager

Good day Team,

I have a application which contains 5 servers. Each server is having different path. But the end is to read error.log and wrapper.log

/log/apple/production/A1/error.log

/log/ball/production/A2/error.log

..

Here I can use regex like this in monitor stanza -- /log/*/prodcution/*/error.log

But the problem is each server is having many folders for that *. I dont want all folders. Need only few. 

Say the first star. I want only apple or ball or cat. If it is any other name in any server I can ignore

Similarly take the second star. I want only A1 or A2  or A3. I can ignore B1 or C1 or so. 

 

So is it possible to write like that using any regex either in inputs itself or using props?

Labels (2)
0 Karma

somesoni2
Revered Legend
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, a MONITOR stanza name can contain a regular expression, but only if that stanza name also uses the "*" or "..." operator.  Those operators trigger the regex parser.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...