Getting Data In

Inputs.conf configuration to monitor 2 catalina log files in same directory with different formats and sourcetypes?

a212830
Champion

Hi,

I need to monitor two catalina logfiles that are in the same directory, but have different formats (and sourcetypes).

The naming convention is ../catalina.YYYY-MM-DD.log and catalina.out.YYYY-MM-DD.log

How would I setup inputs to handle this?

Tags (1)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this in the inputs.conf

Updated

[monitor://your_directory/catalina.*.log] 
disabled = false 
followTail = 0 
sourcetype = your_sourcetype1
whitelist = catalina\.\d+-\d+-\d+\.log

[monitor://your_directory/catalina.out.*.log] 
disabled = false 
followTail = 0 
sourcetype = your_sourcetype2
whitelist = catalina\.out\.\d+-\d+-\d+\.log

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this in the inputs.conf

Updated

[monitor://your_directory/catalina.*.log] 
disabled = false 
followTail = 0 
sourcetype = your_sourcetype1
whitelist = catalina\.\d+-\d+-\d+\.log

[monitor://your_directory/catalina.out.*.log] 
disabled = false 
followTail = 0 
sourcetype = your_sourcetype2
whitelist = catalina\.out\.\d+-\d+-\d+\.log

somesoni2
SplunkTrust
SplunkTrust

My bad, I didn't read the question properly. Try the updated answer.

a212830
Champion

I have different sourcetypes that need to be mapped - the out goes to one sourcetype, the other to a different one. This doesn't appear to address that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...