Getting Data In

Input paths with wildcards for the sub-directories tree

mlevsh
Builder

Hi,

I haven't dealt a lot with wildcards in Paths for Inputs, so will appreciate your help.

We need to monitor logs in SyslogLog sub-directory:

/opt/our-application/var/log/our-processor/message_logging/dev/<environment>/<proxy-name>/<revision>/SyslogLog/name_of_log.log

For example from the following available directories we need to get only 1),4), 5) and 7) ,8), 10)files

1) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log
2) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log.1
3) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log.2
4) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/2/SyslogLog/name_of_2_log.log
5) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/3/SyslogLog/name_of_3_log.log
6) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/3/FastLog/name_of_4_log.log

7) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/1/SyslogLog/name_of_5_log.log
8) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/2/SyslogLog/name_of_6_log.log
9) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/3/FastLog/name_of_7_log.log
10) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/4/SyslogLog/name_of_8_log.log

Will the following template on the Path with "*" work?

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype
0 Karma
1 Solution

woodcock
Esteemed Legend

Missed it by >that< much; try this:

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype

View solution in original post

woodcock
Esteemed Legend

Missed it by >that< much; try this:

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype

woodcock
Esteemed Legend

This assumes that .../dev/dev/... is really the path and not a double-paste error.

0 Karma

mlevsh
Builder

@woodcock , sorry for a delay.
Tested and it worked. Thank you so much as always!

mlevsh
Builder

@woodcock , thank you! Will test tomorrow!
.../dev/dev/... is really the path.
it is possible that users might have other sub-folders under first dev.
Something like .../dev/dev_pse/...

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...