Getting Data In

How do I monitor files in a folder as well as the files in all subfolders?

Path Finder

Hi,

I want to monitor the files in E:\data\pnlog as well as all the files in the subfolders. Is there any way to simplify this or a way to get this done in one stanza?

[monitor://E:\Data\pnlog\...\*]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup

[monitor://E:\Data\pnlog\*]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup

// Andreas

1 Solution

Influencer

If you define a monitor on a folder, it is recursive by default. So if you specify

[monitor://E:\Data\pnlog]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup

It will montor all files recursivly that match the whitelist expression.

View solution in original post

Influencer

If you define a monitor on a folder, it is recursive by default. So if you specify

[monitor://E:\Data\pnlog]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup

It will montor all files recursivly that match the whitelist expression.

View solution in original post

Influencer

Yes. Quote "If the specified directory contains subdirectories, Splunk recursively examines them for new files." in http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

0 Karma

Path Finder

Thank you! Is this to be found in the documentation?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!