Getting Data In

How to configure stanzas in inputs.conf to monitor two paths with the same folder names, but are case sensitive?

rsathish47
Contributor

Hi All,

I need to configure inputs.conf for the folder path below. Can we do it in one stanza, or do we need create two different stanzas?
The difference between the two paths is the log folder name. In some servers, it is in lower case and in some servers it is in upper case.

Folder Path:

d:\Logs\TV_Engine.log
d:\logs\TV_Engine.log

Thanks
Sathish R

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

rsathish47
Contributor

thank you @alacercogitatus
i thought the same.

i tried below but not worked

 [monitor://d:\(l|L)ogs\TV_Engine.log]
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Input stanzas cannot use Regex. * is a special character in this case.

0 Karma

rsathish47
Contributor

can we use like this
[monitor://d:\*ogs\TV_Engine.log]

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...