Getting Data In
Highlighted

How To monitor data for specific months.

Path Finder

I've logs files in the location which has dates like:
/test/01-10-2016/test.log
/test/01-11-2016/test.log

I have to monitor files from October to Feb . Can I write single monitor statement rather than writing separately for all 5 months.

[monitor:////test/01-10-2016/test.log]
index=test

Tags (3)
0 Karma
Highlighted

Re: How To monitor data for specific months.

SplunkTrust
SplunkTrust

you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
hope it helps

Highlighted

Re: How To monitor data for specific months.

Path Finder

Can I do it in one monitor statement?

0 Karma
Highlighted

Re: How To monitor data for specific months.

SplunkTrust
SplunkTrust

if you have logs from March and April 17 you will probably need 3 although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:
[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

0 Karma
Highlighted

Re: How To monitor data for specific months.

Path Finder

Ok. Thanks 🙂

0 Karma
Highlighted

Re: How To monitor data for specific months.

SplunkTrust
SplunkTrust

Combining the comments above:
you can use wildcard in your monitor stanza, for example:
[monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016
here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input...
if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need.
blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata
route and filter data explained here:
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
in this case will just do simple 3 stanzas:

[monitor:////test/01-1*-2016/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-01-2017/test.log]
index=test
sourcetype = yourSourcetype
[monitor:////test/01-02-2017/test.log]
index=test
sourcetype = yourSourcetype

View solution in original post