Getting Data In

Can you help me with wildcard usage in the inputs.conf monitoring path?

damucka
Builder

Hello,

I have the following paths to monitor:

[monitor:///usr/sap/ICP/D15/work/dev_*]
[monitor:///usr/sap/ICP/ASCS14/work/dev_*]

For the several logfile patterns, like dev_*, vmc*, etc.

My idea is to create a separate monitoring entries for each logfile pattern together with the whitelist of it.

However, in order to avoid doubling for the D15 and ASCS15, is it possible to use the wildcards in the monitored path for that?

Like for the example below to use * in the path having sth. as below:

[monitor:///usr/sap/ICP/*/work/dev_*]

Kind Regards,
Kamil

0 Karma
1 Solution

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

0 Karma

FrankVl
Ultra Champion

Both * and ... should work in this case. ... also works if there are more levels of subdirectories, * doesn't match / so only works for 1 level.

0 Karma

damucka
Builder

Would tha be:
[monitor:///usr/sap/ICP/.../dev_*]

?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...