Gettin news data by Universal Forwarder

[michaelteck]

Hello everyone, 

I turn to you because I have a little problem. I have an MFT server that generates logs in a directory. In this directory the log files are stored in directories that have the name of the day. And the log files have the name 1000005847456.log. For example, today’s logs 23 April 2024 are stored in the 2024-04-23/ directory.  For now, I have this input.conf file :

[monitor:///data/logs/.../100000*.log]
disabled=false
sourcetype=log4j
host=PC
followTail=0
index=test_wild

 When I launch the Universal Forwarder, it starts listing all files in/data/logs/.../ . And it also starts to send the data in the log directory as of 4 days ago. I am not looking to retrieve the old log data but the log data of today. I don’t understand this behavior of the Universal Forwarder. Could someone help me? 

[gcusello]

Hi @michaelteck ,

if you give to the monitor command a path, Splunk reads all the file in this path.

You can exclude events older than a data (e.g. 1 day ago), adding a parameter to the input stanza

ignoreOlderThan = 1d

Ciao.

Giuseppe