How can I add new text file everyday?

[maha110192]

Hello splunkies!

I'm trying to be and admin and I'm doing an exercise but I cannot find the way to configure my inputs.conf

here the exercise:

path:  /logfiles/syslog/training-nix01.txt

This file will be updated continuously and will roll daily to training-nix01.1, training-nix01.1 etc

Data from these files should be written to

Index: Training

Sourcetype: tp:tr 

any ideas?

[maha110192]

Thank you very much @gcusello I was doing everthing right except the way to get a new text file daily.

[gcusello · Accepted solution]

Hi @maha110192,

here you can find the full documentation about Gettin Data in https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain , here you can find the documentation about your Use Case https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Monitorfilesanddirectories

In few words, you have to configure the inputs.conf file and you have two ways to do this:

• by GUI if the file is in the same Splunk Server,
• manually modifying the inputs.conf file if the file is in a different server wher you have a Universal Forwarder.

in both cases, you'll have a new stanza in inputs.conf stanza:

[monitor://logfiles/syslog/training-nix*]
disabled = 0
index = Training
sourcetype = tp:tr

if you manually modify the inputs.conf file, you have to restart Splunk on the system where the file is located.

Ciao.

Giuseppe