Getting Data In

Monitor files in a Windows Directory with wildcards

jeffbat
Path Finder

I am having a problem trying to monitor some files on some Windows servers.

The directories that I am trying to pick up the files from are:
D:\webroot\www.foo1.foo.cd\App_Data\logs
D:\webroot\www.foo1.foo.cm\App_Data\logs

And the file name will be similar to this:
Aggregation.log.20191103.224856.txt

I am needing to use wildcards in the path because the portion which is www.foo1.foo. changes based on which environment we are looking at and want to ensure as they bring up different environments the files are just automatically consumed.

I tried using an * in the path and it did not work. this is the inputs section right now (which is still not working):

Blockquote

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cm
whitelist = .+cm\App_Data\logs\Aggregation.+.txt$

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cd
whitelist = .+cd\App_Data\logs\Aggregation.+.txt$

Blockquote

any idea what I have wrong ?

woodcock
Esteemed Legend

Try this:

[monitor://D:\webroot\*.cm\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cm

[monitor://D:\webroot\*.cd\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cd
0 Karma

jeffbat
Path Finder

I tried that one (I actually thing that is the exact one that I originally used) but adding in the \logs part before Aggregation as you were slightly off with the directory name.

No luck on the files getting picked up.

Is there an issue with the fact that there is a wildcard in the path as well as a wildcard in the filename?

These seem to be the only files I am not able to get picked up.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jeffbat,
did you tried to check the path you used in monitor stanza using the dir command?

dir D:\webroot\*.cm\App_Data\logs\Aggregation.*.txt

do you have the file to monitor list?

Ciao.
Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic Operations Start with Context: Build the Right Data Foundation

Agentic Operations Start with Context: Build the Right Data Foundation   By Courtney Wright, Product Marketing ...

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point   By Courtney Wright, Product Marketing ...

Session 2 | Beyond the Thread: Operationalizing AI with Confidence

Session 2   Beyond the Thread: Operationalizing AI with Confidence    The true power of the Cisco Data Fabric ...