Getting Data In

How to monitor a log file on UNIX where file name has date and PID which which are not static all the time.?

rohithmn3
New Member

Hi Team,

My file name looks like below:

SASMeta_MetadataServer_2017-04-21_auq4066l_9175164.log
<-----constant------->_<cur-date>_<host>_<PID>.log

How shall i monitor this file content, it's a rotating file and each day a new file gets created..!

inputs.conf

[monitor:///var/logs/system/local]
whitelist = 

What would be the whitelist for the above filename..!?
Please help here.

Regards,
Rohith

0 Karma
1 Solution

dineshraj9
Builder

You could configure the inputs this way -

[monitor:///var/logs/system/local/SASMeta_MetadataServer_*.log] 
index = index_name 
sourcetype = sourcetype_name
crcSalt=<SOURCE>

So any log file which starts with "SASMeta_MetadataServer_" will be read.

View solution in original post

0 Karma

dineshraj9
Builder

You could configure the inputs this way -

[monitor:///var/logs/system/local/SASMeta_MetadataServer_*.log] 
index = index_name 
sourcetype = sourcetype_name
crcSalt=<SOURCE>

So any log file which starts with "SASMeta_MetadataServer_" will be read.

0 Karma

rohithmn3
New Member

Hi Dinesh,

This monitor all files that starts with SASMeta_MetadataServer_*. In the above path there are multiple files and all starts with the same. So i don't want to monitor all. Is there a way i can only monitor the latest file..!?

0 Karma

dineshraj9
Builder

Hi Rohith,

You could add an ignoreOlderThan setting in inputs.conf.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

[monitor:///var/logs/system/local/SASMeta_MetadataServer_*.log] 
index = index_name 
sourcetype = sourcetype_name
crcSalt=<SOURCE>
ignoreOlderThan = 2d
0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...