Getting Data In

Splunk Monitor Stazas

siva_cg
Path Finder

Hi Team,

We have a distributed environment with several forwarders managed by Deployment Server. Recently, I have configured few logs paths as below

[monitor:///appl_*/logs/wserv/]
whitelist = access_logs_wasLC*_PROD_\.\d{8}
blacklist = \.gz
recursive = true
index = was_logs
sourcetype = ibm:was:app

[monitor:///appl_*/logs/wserv/]
whitelist = access_logs_wasCC*_LUAT_\.\d{8}
blacklist = \.gz
recursive = true
index = luat_was_logs
sourcetype = ibm:was:app

Both the Prod and LUAT environment servers are in the same server class. Now the issue is even the Prod logs are going to LUAT index. So could you please help me in resolving this issue? Is there any priority when the path is same?

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi siva_cg,
try with this configuration:

[monitor:///appl_/logs/wserv/access_logs_wasLCPROD.*]
blacklist = .gz
recursive = true
index = was_logs
sourcetype = ibm:was:app

[monitor:///appl_/logs/wserv/access_logs_wasCCLUAT.*]
blacklist = .gz
recursive = true
index = luat_was_logs
sourcetype = ibm:was:app

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi siva_cg,
try with this configuration:

[monitor:///appl_/logs/wserv/access_logs_wasLCPROD.*]
blacklist = .gz
recursive = true
index = was_logs
sourcetype = ibm:was:app

[monitor:///appl_/logs/wserv/access_logs_wasCCLUAT.*]
blacklist = .gz
recursive = true
index = luat_was_logs
sourcetype = ibm:was:app

Bye.
Giuseppe

0 Karma

siva_cg
Path Finder

It worked. Thank you cusello:)

0 Karma

siva_cg
Path Finder

Hi Giuseppe,

We have regular expression in the whitelist. The exact whitelist value is as below:
((access|error|access_ssl|error_ssl)log_was85CC[0-9]_A201_DigitalCA(IBC|IBR|DQMU)LUAT*[BW]1)?(|.\d{8}00)$

So will this regular expression be included in the monitor path? I will use a wildcard before this regular expression but just want to know whether we can include regular expression in the monitor path?

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...