Getting Data In

How do I read just one file in a app?

approachct
Path Finder

I want to be able to push down a single application which contains an inputs.conf to monitor files on a Oracle RAC system.

There are three nodes and each system should just read its own file, however the issue is they are on a shared filesystem. Each node is active in this type of cluster. The application would look something like -

 [monitor:///temp/log/abc1/alert_abc1.log]
 ...

 [monitor:///temp/log/abc2/alert_abc2.log]
 ...

 [monitor:///temp/log/abc3/alert_abc3.log]
 ....

Ideally I would want to have a whitelist = specific hostname on each stanza, similar to the syntax in serverclass.conf. It would look something like

 [monitor:///temp/log/abc1/alert_abc1.log]
 whitelist.0 = node1*
 ...

 [monitor:///temp/log/abc2/alert_abc2.log
 whitelist.0 = node2*
 ...

 [monitor:///temp/log/abc3/alert_abc3.log]
 whitelist.0= node3*
 ....

I realize I could push three separate apps, but that will become a maintenance nightmare down the road.

Thanks for any ideas.

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee

If it is on a shared filesystem, why not set up one machine to read all three files, or even set up a dedicated forwarder to monitor the shared file system?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Watch on demand us for a demo-driven ...