Getting Data In

Monitor files in a Windows Directory with wildcards

jeffbat
Path Finder

I am having a problem trying to monitor some files on some Windows servers.

The directories that I am trying to pick up the files from are:
D:\webroot\www.foo1.foo.cd\App_Data\logs
D:\webroot\www.foo1.foo.cm\App_Data\logs

And the file name will be similar to this:
Aggregation.log.20191103.224856.txt

I am needing to use wildcards in the path because the portion which is www.foo1.foo. changes based on which environment we are looking at and want to ensure as they bring up different environments the files are just automatically consumed.

I tried using an * in the path and it did not work. this is the inputs section right now (which is still not working):

Blockquote

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cm
whitelist = .+cm\App_Data\logs\Aggregation.+.txt$

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cd
whitelist = .+cd\App_Data\logs\Aggregation.+.txt$

Blockquote

any idea what I have wrong ?

woodcock
Esteemed Legend

Try this:

[monitor://D:\webroot\*.cm\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cm

[monitor://D:\webroot\*.cd\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cd
0 Karma

jeffbat
Path Finder

I tried that one (I actually thing that is the exact one that I originally used) but adding in the \logs part before Aggregation as you were slightly off with the directory name.

No luck on the files getting picked up.

Is there an issue with the fact that there is a wildcard in the path as well as a wildcard in the filename?

These seem to be the only files I am not able to get picked up.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jeffbat,
did you tried to check the path you used in monitor stanza using the dir command?

dir D:\webroot\*.cm\App_Data\logs\Aggregation.*.txt

do you have the file to monitor list?

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...