I've logs files in the location which has dates like:
/test/01-10-2016/test.log
/test/01-11-2016/test.log
I have to monitor files from October to Feb . Can I write single monitor statement rather than writing separately for all 5 months.
[monitor:////test/01-10-2016/test.log]
index=test
Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log]
will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:
[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype
Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log]
will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:
[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log]
will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
hope it helps
Can I do it in one monitor statement?
if you have logs from March and April 17 you will probably need 3 although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:
[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype
Ok. Thanks 🙂