Getting Data In

How to configure stanzas in inputs.conf to monitor two paths with the same folder names, but are case sensitive?

rsathish47
Contributor

Hi All,

I need to configure inputs.conf for the folder path below. Can we do it in one stanza, or do we need create two different stanzas?
The difference between the two paths is the log folder name. In some servers, it is in lower case and in some servers it is in upper case.

Folder Path:

d:\Logs\TV_Engine.log
d:\logs\TV_Engine.log

Thanks
Sathish R

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

rsathish47
Contributor

thank you @alacercogitatus
i thought the same.

i tried below but not worked

 [monitor://d:\(l|L)ogs\TV_Engine.log]
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Input stanzas cannot use Regex. * is a special character in this case.

0 Karma

rsathish47
Contributor

can we use like this
[monitor://d:\*ogs\TV_Engine.log]

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...