Getting Data In

How to monitor 2 different file types in the same folder

splunkIT
Splunk Employee
Splunk Employee

If I need to monitor 2 different file types in the same folder and send them to different indexes, how do I do that?

Tags (2)

DerekB
Splunk Employee
Splunk Employee

I would setup 2 separate monitor stanzas that monitor the folder.
In each stanza I would create a whitelist for the specific file type, such as:

[monitor:///mnt/logs/*.log]
index=test1

[monitor:///mnt/logs/*.txt]
index=test2

This should direct the .log events to the test1 index and send .txt to test2.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...