Getting Data In

Can you help me with wildcard usage in the inputs.conf monitoring path?

damucka
Builder

Hello,

I have the following paths to monitor:

[monitor:///usr/sap/ICP/D15/work/dev_*]
[monitor:///usr/sap/ICP/ASCS14/work/dev_*]

For the several logfile patterns, like dev_*, vmc*, etc.

My idea is to create a separate monitoring entries for each logfile pattern together with the whitelist of it.

However, in order to avoid doubling for the D15 and ASCS15, is it possible to use the wildcards in the monitored path for that?

Like for the example below to use * in the path having sth. as below:

[monitor:///usr/sap/ICP/*/work/dev_*]

Kind Regards,
Kamil

0 Karma
1 Solution

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

0 Karma

FrankVl
Ultra Champion

Both * and ... should work in this case. ... also works if there are more levels of subdirectories, * doesn't match / so only works for 1 level.

0 Karma

damucka
Builder

Would tha be:
[monitor:///usr/sap/ICP/.../dev_*]

?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...