Getting Data In
Highlighted

How do I monitor files in a folder as well as the files in all subfolders?

Path Finder

Hi,

I want to monitor the files in E:\data\pnlog as well as all the files in the subfolders. Is there any way to simplify this or a way to get this done in one stanza?

[monitor://E:\Data\pnlog\...\*]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup

[monitor://E:\Data\pnlog\*]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup

// Andreas

Highlighted

Re: How do I monitor files in a folder as well as the files in all subfolders?

Influencer

If you define a monitor on a folder, it is recursive by default. So if you specify

[monitor://E:\Data\pnlog]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup

It will montor all files recursivly that match the whitelist expression.

View solution in original post

Highlighted

Re: How do I monitor files in a folder as well as the files in all subfolders?

Path Finder

Thank you! Is this to be found in the documentation?

0 Karma
Highlighted

Re: How do I monitor files in a folder as well as the files in all subfolders?

Influencer

Yes. Quote "If the specified directory contains subdirectories, Splunk recursively examines them for new files." in http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

0 Karma