Getting Data In

Need help ingesting /var/log/mail.log.1

rene_splunk
Explorer

I have a number of log-rotated files for mail.log in the /var/log folder on a unix system. The /var/log/mail.log file gets ingested just fine, so I know permissions aren't an issue. However, I'd like to also ingest the older data that was log-rotated, but for the purpose of ingesting, those files were untarred again, so I have mail.log.1 to mail.log.4

I have tried numerous stanzas and regexes in the whitelist, but none lead to the older data getting ingested. 

The one I currently have in place is:


[monitor:///var/log/]
index = postfix
sourcetype = postfix_syslog
whitelist = (mail\.log$|mail\.log\.\d+)

Thanks for any suggestions in advance.

 

Labels (3)
0 Karma

rene_splunk
Explorer

Thanks Giuseppe,

I don't see any historical data in my index as yet, this is what's in the splunkd.log file

splunk_inputs.png

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rene_splunk,

please try this:

[monitor:///var/log/mail.log*]
index = postfix
sourcetype = postfix_syslog

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...