Getting Data In

Configure input.conf

moohkhol
New Member

All,

I want to monitor Apache log and file name is appended with date, so it's dynamic file. eg,

Log directory:
/var/apache/logs/
File name is,
apache_log.2014.02.20
apache_log.2014.02.19
apache_log.2014.02.18
apache_log.2014.02.17.gz
apache_log.2014.02.16.gz

Running log is coming into apache_log.2014.02.20 and I also want to ignore all the files with *.gz name, since old files are getting archived and present into same directory (/var/apache/logs/).
Please some one can give details about stanza of input.conf and other details if required.

Tags (2)
0 Karma

moohkhol
New Member

Yes, Thankx

0 Karma

Ayn
Legend

Note that the file is called "inputs.conf", not input.conf.

0 Karma

kristian_kolb
Ultra Champion

Name your index and sourcetype - the latter likely to access_combined, or access_common

[monitor:///var/apache/log/apache_log*]
index = your_index
sourcetype = your_sourcetype
blacklist = \.gz

/K

0 Karma

kristian_kolb
Ultra Champion

you can add some more information to the monitor path (like above), or define a whitelist as well, which should amount to the same thing. See;

http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Specifyinputpathswithwildcards#Wildcards_and_...

/K

0 Karma

moohkhol
New Member

Thankx Kristain,
"/var/apache/log/" also contains different logs such as Mod_jk, error, ssl logs, so i want to specify something like that, Monitor should able to read file only with name of apache_log... and i can also able to specify it should not read before some date, lets say if I am configuring today than it should start from today should not read apache_log.2014.02.19 apache_log.2014.02.18 file.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...