Getting Data In

Can you help me with wildcard usage in the inputs.conf monitoring path?

damucka
Builder

Hello,

I have the following paths to monitor:

[monitor:///usr/sap/ICP/D15/work/dev_*]
[monitor:///usr/sap/ICP/ASCS14/work/dev_*]

For the several logfile patterns, like dev_*, vmc*, etc.

My idea is to create a separate monitoring entries for each logfile pattern together with the whitelist of it.

However, in order to avoid doubling for the D15 and ASCS15, is it possible to use the wildcards in the monitored path for that?

Like for the example below to use * in the path having sth. as below:

[monitor:///usr/sap/ICP/*/work/dev_*]

Kind Regards,
Kamil

0 Karma
1 Solution

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

0 Karma

FrankVl
Ultra Champion

Both * and ... should work in this case. ... also works if there are more levels of subdirectories, * doesn't match / so only works for 1 level.

0 Karma

damucka
Builder

Would tha be:
[monitor:///usr/sap/ICP/.../dev_*]

?

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...