Getting Data In

How To monitor data for specific months.

isha_rastogi
Path Finder

I've logs files in the location which has dates like:
/test/01-10-2016/test.log
/test/01-11-2016/test.log

I have to monitor files from October to Feb . Can I write single monitor statement rather than writing separately for all 5 months.

[monitor:////test/01-10-2016/test.log]
index=test

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:

[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

View solution in original post

adonio
Ultra Champion

Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:

[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

adonio
Ultra Champion

you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
hope it helps

isha_rastogi
Path Finder

Can I do it in one monitor statement?

0 Karma

adonio
Ultra Champion

if you have logs from March and April 17 you will probably need 3 although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:
[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

0 Karma

isha_rastogi
Path Finder

Ok. Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...