Hi, I'm setting up Splunk Universal Forwarder to watch logs generated from an application I have in AWS Elastic Beanstalk. This is done by running shell script installing the Universal Forwarder and setting up monitors.
Simple enough. The problem is my application logs into a rolling file, meaning after a certain amount of data has been entered into the file (10MB in this example) it then creates a new file in the same location named "example 1.log" then "example 2.log", etc.
Currently I've tried using the below command to set up all the monitors with no success:
/opt/splunkforwarder/bin/splunk add monitor "/var/logs/example*"
How can I capture all the files it will create?
