Getting Data In

Monitor files in a Windows Directory with wildcards

jeffbat
Path Finder

I am having a problem trying to monitor some files on some Windows servers.

The directories that I am trying to pick up the files from are:
D:\webroot\www.foo1.foo.cd\App_Data\logs
D:\webroot\www.foo1.foo.cm\App_Data\logs

And the file name will be similar to this:
Aggregation.log.20191103.224856.txt

I am needing to use wildcards in the path because the portion which is www.foo1.foo. changes based on which environment we are looking at and want to ensure as they bring up different environments the files are just automatically consumed.

I tried using an * in the path and it did not work. this is the inputs section right now (which is still not working):

Blockquote

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cm
whitelist = .+cm\App_Data\logs\Aggregation.+.txt$

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cd
whitelist = .+cd\App_Data\logs\Aggregation.+.txt$

Blockquote

any idea what I have wrong ?

woodcock
Esteemed Legend

Try this:

[monitor://D:\webroot\*.cm\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cm

[monitor://D:\webroot\*.cd\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cd
0 Karma

jeffbat
Path Finder

I tried that one (I actually thing that is the exact one that I originally used) but adding in the \logs part before Aggregation as you were slightly off with the directory name.

No luck on the files getting picked up.

Is there an issue with the fact that there is a wildcard in the path as well as a wildcard in the filename?

These seem to be the only files I am not able to get picked up.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jeffbat,
did you tried to check the path you used in monitor stanza using the dir command?

dir D:\webroot\*.cm\App_Data\logs\Aggregation.*.txt

do you have the file to monitor list?

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...