Configure input.conf

[moohkhol]

All,

I want to monitor Apache log and file name is appended with date, so it's dynamic file. eg,

Log directory:
/var/apache/logs/
File name is,
apache_log.2014.02.20
apache_log.2014.02.19
apache_log.2014.02.18
apache_log.2014.02.17.gz
apache_log.2014.02.16.gz

Running log is coming into apache_log.2014.02.20 and I also want to ignore all the files with *.gz name, since old files are getting archived and present into same directory (/var/apache/logs/).
Please some one can give details about stanza of input.conf and other details if required.

[moohkhol]

Yes, Thankx

[Ayn]

Note that the file is called "inputs.conf", not input.conf.

[kristian_kolb]

Name your index and sourcetype - the latter likely to access_combined, or access_common

[monitor:///var/apache/log/apache_log*]
index = your_index
sourcetype = your_sourcetype
blacklist = \.gz

/K

[kristian_kolb]

you can add some more information to the monitor path (like above), or define a whitelist as well, which should amount to the same thing. See;

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Specifyinputpathswithwildcards#Wildcards_and_...

/K

[moohkhol]

Thankx Kristain,
"/var/apache/log/" also contains different logs such as Mod_jk, error, ssl logs, so i want to specify something like that, Monitor should able to read file only with name of apache_log... and i can also able to specify it should not read before some date, lets say if I am configuring today than it should start from today should not read apache_log.2014.02.19 apache_log.2014.02.18 file.