Getting Data In

How To monitor data for specific months.

isha_rastogi
Path Finder

I've logs files in the location which has dates like:
/test/01-10-2016/test.log
/test/01-11-2016/test.log

I have to monitor files from October to Feb . Can I write single monitor statement rather than writing separately for all 5 months.

[monitor:////test/01-10-2016/test.log]
index=test

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:

[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

View solution in original post

adonio
Ultra Champion

Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:

[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

adonio
Ultra Champion

you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
hope it helps

isha_rastogi
Path Finder

Can I do it in one monitor statement?

0 Karma

adonio
Ultra Champion

if you have logs from March and April 17 you will probably need 3 although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:
[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

0 Karma

isha_rastogi
Path Finder

Ok. Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...