I am looking for a way to monitor a folder for files that are [not yet defined] into a sourcetype so that i can have a report of un-indexed log files in splunk to review on occasion.
We have a custom application that comes with default logs, but it also allows the architects to create custom logs based on modules that are added on top of the default build. So each implementation of the application will have the 4 base logs + any number of other logtypes in the same folder. Each time we run across an implementation with a new log type, we build the new source type, if we deem it necessary, but we'd like to know when and if that new log type appears in the folder, even if it's not yet being indexed.
basically, i want this:
Splunk says:
I found the following files, and have parsed them accordingly:
log.foo - sourcetype:foo
log.bar - sourcetype:bar
log.zoo - sourcetype:zoo
log.foo2 - sourcetype:foo
I also found this, but i didn't know what to do with it, so here's an alert:
log.zam
At which point we can decide if log.zam is worth monitoring, whether or not we need a new sourcetype for it, and then work on getting it indexed into splunk
