Getting Data In

How to configure stanzas in inputs.conf to monitor two paths with the same folder names, but are case sensitive?

rsathish47
Contributor

Hi All,

I need to configure inputs.conf for the folder path below. Can we do it in one stanza, or do we need create two different stanzas?
The difference between the two paths is the log folder name. In some servers, it is in lower case and in some servers it is in upper case.

Folder Path:

d:\Logs\TV_Engine.log
d:\logs\TV_Engine.log

Thanks
Sathish R

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

View solution in original post

rsathish47
Contributor

thank you @alacercogitatus
i thought the same.

i tried below but not worked

 [monitor://d:\(l|L)ogs\TV_Engine.log]
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Input stanzas cannot use Regex. * is a special character in this case.

0 Karma

rsathish47
Contributor

can we use like this
[monitor://d:\*ogs\TV_Engine.log]

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!