Getting Data In

Monitor files in a Windows Directory with wildcards

jeffbat
Path Finder

I am having a problem trying to monitor some files on some Windows servers.

The directories that I am trying to pick up the files from are:
D:\webroot\www.foo1.foo.cd\App_Data\logs
D:\webroot\www.foo1.foo.cm\App_Data\logs

And the file name will be similar to this:
Aggregation.log.20191103.224856.txt

I am needing to use wildcards in the path because the portion which is www.foo1.foo. changes based on which environment we are looking at and want to ensure as they bring up different environments the files are just automatically consumed.

I tried using an * in the path and it did not work. this is the inputs section right now (which is still not working):

Blockquote

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cm
whitelist = .+cm\App_Data\logs\Aggregation.+.txt$

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cd
whitelist = .+cd\App_Data\logs\Aggregation.+.txt$

Blockquote

any idea what I have wrong ?

woodcock
Esteemed Legend

Try this:

[monitor://D:\webroot\*.cm\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cm

[monitor://D:\webroot\*.cd\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cd
0 Karma

jeffbat
Path Finder

I tried that one (I actually thing that is the exact one that I originally used) but adding in the \logs part before Aggregation as you were slightly off with the directory name.

No luck on the files getting picked up.

Is there an issue with the fact that there is a wildcard in the path as well as a wildcard in the filename?

These seem to be the only files I am not able to get picked up.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jeffbat,
did you tried to check the path you used in monitor stanza using the dir command?

dir D:\webroot\*.cm\App_Data\logs\Aggregation.*.txt

do you have the file to monitor list?

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...