Hello fellow splunkers!
I'm about to set up an universal forwarder monitoring a specific path on a server.
On this server I have some files in the following directory /this/is/an/example/.
The actual files are named like in this example:
AB0101262016
AB0201262016
...
AB1001262016
"AB01" is the name of the instance and will be constant everyday and the rest "01262016" is the date which will of course change everyday.
I thought of an inputs.conf stanza that looks like the following:
[monitor:///this/is/an/example/AB01*.txt]
disabled = false
index = example_application
sourcetype = example_application_admin_log
host = example_application_AB01
crcSalt = <SOURCE>
ignoreOlderThan = 1d
Is the use of the * wildcard legit?
Is this stanza legit?
Any Idea how to make this set up more efficient, because I need to set up 10 individual stanza's now for AB01 - AB10. (it's not that bad, only if you have an idea)
Thanks in advance!
Kind regards,
pyro_wood
In principle I don't see anything wrong but I would definitely go through the following doc first:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards
With regards to your second question (AB01 to AB10), if all your files are in the same directory, wouldn't the following work for you?
[monitor:///this/is/an/example/AB*.txt]
Alternatively you can use regex (see doc above for details), something like maybe:
[monitor:///this/is/an/example/AB[0-9][0-9]*.txt]
In principle I don't see anything wrong but I would definitely go through the following doc first:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards
With regards to your second question (AB01 to AB10), if all your files are in the same directory, wouldn't the following work for you?
[monitor:///this/is/an/example/AB*.txt]
Alternatively you can use regex (see doc above for details), something like maybe:
[monitor:///this/is/an/example/AB[0-9][0-9]*.txt]
Hi javiergn,
thank you for your answer. Its very helpful and exactly what I was searching for 🙂
I don't think I'm able to do the second thing like that, because i want to assign the host value with a variable ABxx value everytime.