Getting Data In

Can we use OR condition in monitoring stanza

Naga
Engager

Good day Team,

I have a application which contains 5 servers. Each server is having different path. But the end is to read error.log and wrapper.log

/log/apple/production/A1/error.log

/log/ball/production/A2/error.log

..

Here I can use regex like this in monitor stanza -- /log/*/prodcution/*/error.log

But the problem is each server is having many folders for that *. I dont want all folders. Need only few. 

Say the first star. I want only apple or ball or cat. If it is any other name in any server I can ignore

Similarly take the second star. I want only A1 or A2  or A3. I can ignore B1 or C1 or so. 

 

So is it possible to write like that using any regex either in inputs itself or using props?

Labels (2)
0 Karma

somesoni2
Revered Legend
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, a MONITOR stanza name can contain a regular expression, but only if that stanza name also uses the "*" or "..." operator.  Those operators trigger the regex parser.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...