Getting Data In

How to use wildcards on inputs.conf to monitor specific directories?

a212830
Champion

Hi,

I need to monitor the following:

/apps/log//access/today

today is the file, but the webserver name directory could be almost anything. Some begin with www, some begin with https, some have dashes, some have .com....

What can I enter so that I monitor any dir that has -8443 (and then the subdirs listed).

1 Solution

strive
Influencer

I did a quick test and this works. Try it

/apps/log/*-8443*/access/today

The directories that i created are like this

/apps/log/abc-8443=123/access/today  
/apps/log/abc.123.-8443=123/access/today  
/apps/log/123_abc_def.efg-8443=456/access/today
/apps/log/abc-8000=123/access/today

alt text

View solution in original post

strive
Influencer

I did a quick test and this works. Try it

/apps/log/*-8443*/access/today

The directories that i created are like this

/apps/log/abc-8443=123/access/today  
/apps/log/abc.123.-8443=123/access/today  
/apps/log/123_abc_def.efg-8443=456/access/today
/apps/log/abc-8000=123/access/today

alt text

a212830
Champion

I'm weak on regex. My concern is that something with multiple dots or dashes won't get picked up.

0 Karma

strive
Influencer

did you try something like this
/apps/log/-8443/access/today

wildcards are not displayed in comment

/apps/log/star-8443star/access/today

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...