Getting Data In

How do I read just one file in a app?

approachct
Path Finder

I want to be able to push down a single application which contains an inputs.conf to monitor files on a Oracle RAC system.

There are three nodes and each system should just read its own file, however the issue is they are on a shared filesystem. Each node is active in this type of cluster. The application would look something like -

 [monitor:///temp/log/abc1/alert_abc1.log]
 ...

 [monitor:///temp/log/abc2/alert_abc2.log]
 ...

 [monitor:///temp/log/abc3/alert_abc3.log]
 ....

Ideally I would want to have a whitelist = specific hostname on each stanza, similar to the syntax in serverclass.conf. It would look something like

 [monitor:///temp/log/abc1/alert_abc1.log]
 whitelist.0 = node1*
 ...

 [monitor:///temp/log/abc2/alert_abc2.log
 whitelist.0 = node2*
 ...

 [monitor:///temp/log/abc3/alert_abc3.log]
 whitelist.0= node3*
 ....

I realize I could push three separate apps, but that will become a maintenance nightmare down the road.

Thanks for any ideas.

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee

If it is on a shared filesystem, why not set up one machine to read all three files, or even set up a dedicated forwarder to monitor the shared file system?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make your Splunk investment work harder with Optimization Advisor

Value Insights brings usage evidence and practical recommendations together to help customers make more ...

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...