Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Monitor different sourcetype in sub-directorie...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Monitor different sourcetype in sub-directories
I have to monitor two source types in this following directory structure
\\Server\Path\{can be any name}.log == > sourcetype = FirstLog
\\Server\Path\SubPath\{can be any name}.csv == > sourcetype = SecondLog
How do I set up the inputs.conf? Right now, my first monitor for \\Server\Path is working but the next monitor for \\Server\Path\SubPath is not working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Set the monitor specific to the file in your inputs.conf :
[monitor://\\Server\share\*.log]
sourcetype = FirstLog
[monitor://\\Server\Share\Directory\*.csv]
sourcetype = SecondLog
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It was a suggestion is you are have trouble accessing the files by UNC path. I modified the example to reflect using a wildcard for the file name.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, I don't understand what it has anything to do with my problem with assigning log files from subdirectories to different sourcetype.
*** Also I can't hard code the name of the log files because as I described log file name can vary. It can be any name.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The inputs.conf example should still work. If you are using UNC paths then you might want to take a look at this:
http://splunk-base.splunk.com/answers/35281/splunk-index-logs-from-network-drive
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, the slashes didn't show up correctly in my message. That's not what I need. I updated the message above.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
