Getting Data In

Need help for monitoring files

hrca33
Explorer

I am monitoring couple of files by specifying same source type.

Inputs.conf:-

[monitor://D:**\Installations*\Logs*\XYZ]
sourcetype = abc
index = ******
disabled = false
ignoreOlderThan = 2d

[monitor://D:**\Installations*\Logs*\fgh]
sourcetype = abc
index = ******
disabled = false
ignoreOlderThan = 2d

Now, I need to monitor the same path not individually mentioning the file names by using wildcards. Here I am using different source type.

[monitor://D:**\Installations*\Logs**.log]
sourcetype = xyz
index = ******
disabled = false
ignoreOlderThan = 2d

Is this works??

need help

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi hrca33,
if your "XYZ" and "fhg" files have both ".log" extension, you could use
[monitor://D:\Installations\Logs**.log]

if they have different names and in the Log* directories there aren't other files with .log extension, you can use
[monitor://D:\Installations\Logs*]

if they have different names and in the directories there are other files easily identified (e.g.: .php), you can use
[monitor://D:
\Installations\Logs*]
blacklist = *.php

Bye.
Giuseppe

0 Karma

ddrillic
Ultra Champion

What about the index name? I see index = **. What's the intention?

0 Karma

hrca33
Explorer

Am using the same index.

0 Karma

ddrillic
Ultra Champion

Got it - does it work?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...