Getting Data In

Help with input monitoring

a212830
Champion

Hi,

I need to monitor some logs where I need to wildcard part of the hostname into the path. Is that possible:

For example, I have:

/apps/oracle/install/admin/instances
/apps/oracle/install/admin/instances/ovdpmmk1a
/apps/oracle/install/admin/instances/ovdpmmk1b
/apps/oracle/install/admin/instances/ovdpmmk2a
/apps/oracle/install/admin/instances/ovdpmmk2b
/apps/oracle/install/admin/instances/ovdpmmk3a
/apps/oracle/install/admin/instances/ovdpmmk3b... (it keeps going)

The hostname is ovdpmmk1. On this server, I want to monitor certain files in the ovdpmmk1a and 1b directories. On the ovdpmmk2 server, I want to monitor certain files in the ovdpmmk2a and 2b directory. Is there a way to take the hostname and make it part of the inputs?

So monitor:.../apps/oracle/install/admin/instances/REGEXFORHOSTNAME/myfile?

Tags (2)
0 Karma

pmdba
Builder

I begin to see the difficulty. I haven't tried this - perhaps you have already - but would something like this work?

 /apps/oracle/install/admin/instances/${hostname}*

You just need a common environment variable that returns the hostname...

0 Karma

a212830
Champion

That's what I'm looking for... I'll try it. Wasn't sure which variables that are allowed in stanza's....

0 Karma

pmdba
Builder

You can use wildcards in the path. E.g. /apps/oracle/install/admin/instances/*/myfile

For a look at a variety of input types, including this one, check out Log File Analysis for Oracle 11g on the apps.splunk.com web site.

0 Karma

a212830
Champion

I don't think wildcards will work in this case, if I want to use only one input. Looking for hostname variable or something like that...

0 Karma

pmdba
Builder

I use wildcards for similar situations. For instance, I pick up alert log files for Oracle with something like this:

monitor:///apps/oracle/diag/rdbms/*/*/trace/alert*.log

This picks up all alert logs on the system for every database, including any that I might add in the future, with one input. In your case I would think something like this would work:

/apps/oracle/install/admin/instances/ovdpmmk*
0 Karma

a212830
Champion

That won't work because there are 4 directories of ovdpmmk on each server, and I only want the one that matches the hostname. So, if the hostname is ovdpmmk1, I want that one, if it's ovdpmmk2, I want ovdpmmk2....

0 Karma

a212830
Champion

Does this still apply? Pretty old...seems like a similar situation.

http://blogs.splunk.com/2009/07/09/monitoring-input-files-with-a-white-list/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...