Getting Data In

How to set source from directory monitor filepath inputs.conf

New Member

I have a directory monitor setup like below:

disabled = false
host_regex = (\w+)-\w+\.log\..*$
index = this_data_index
sourcetype = some_sourcetype

The log files that I am monitoring in this directory are day-of-the-week log files (i.e., fooBar.log.tu, etc.). Currently, the source is being set to the default path some/path/to/my/DATA/ but what I would like to do is strip off the day extension so that my source would be some/path/to/my/DATA/helloWorld-text.log regardless of which day file it loaded.

I've been looking around but have yet to find an answer that really applies to my situation. Any help would be greatly appreciated!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!