Getting Data In

Monitor doesn't work with the path including a space character

hi_sekine
New Member

Is there any workaround ?

I have logs that path beginning with space character. But Splunk doesn't detect them.

Sample files:
Log\20120711\ 0313139\Name54detail.log
Log\20120711\ 1281020\Name55detail.log

inputs.conf:
[monitor://E:\user05...Nam*[Dd]etai*.[Ll][Oo][Gg]]

Tags (1)
0 Karma
1 Solution

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

View solution in original post

0 Karma

hi_sekine
New Member

Thank you for your help, Mr. Takjian.

I'd been confused about "source" display of splunk.
I wondered "source" was less than monitor files.

But the monitor files had duplicated contents. Same lines were recorded on files in different directories.
Then the "source" was less than monitor files.

It seems that there is no lack of file contents.

I'm sorry about my confusion.

0 Karma

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...