Getting Data In

Monitor doesn't work with the path including a space character

hi_sekine
New Member

Is there any workaround ?

I have logs that path beginning with space character. But Splunk doesn't detect them.

Sample files:
Log\20120711\ 0313139\Name54detail.log
Log\20120711\ 1281020\Name55detail.log

inputs.conf:
[monitor://E:\user05...Nam*[Dd]etai*.[Ll][Oo][Gg]]

Tags (1)
0 Karma
1 Solution

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

View solution in original post

0 Karma

hi_sekine
New Member

Thank you for your help, Mr. Takjian.

I'd been confused about "source" display of splunk.
I wondered "source" was less than monitor files.

But the monitor files had duplicated contents. Same lines were recorded on files in different directories.
Then the "source" was less than monitor files.

It seems that there is no lack of file contents.

I'm sorry about my confusion.

0 Karma

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...