Getting Data In

Splunk Monitor Stazas

siva_cg
Path Finder

Hi Team,

We have a distributed environment with several forwarders managed by Deployment Server. Recently, I have configured few logs paths as below

[monitor:///appl_*/logs/wserv/]
whitelist = access_logs_wasLC*_PROD_\.\d{8}
blacklist = \.gz
recursive = true
index = was_logs
sourcetype = ibm:was:app

[monitor:///appl_*/logs/wserv/]
whitelist = access_logs_wasCC*_LUAT_\.\d{8}
blacklist = \.gz
recursive = true
index = luat_was_logs
sourcetype = ibm:was:app

Both the Prod and LUAT environment servers are in the same server class. Now the issue is even the Prod logs are going to LUAT index. So could you please help me in resolving this issue? Is there any priority when the path is same?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi siva_cg,
try with this configuration:

[monitor:///appl_/logs/wserv/access_logs_wasLCPROD.*]
blacklist = .gz
recursive = true
index = was_logs
sourcetype = ibm:was:app

[monitor:///appl_/logs/wserv/access_logs_wasCCLUAT.*]
blacklist = .gz
recursive = true
index = luat_was_logs
sourcetype = ibm:was:app

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi siva_cg,
try with this configuration:

[monitor:///appl_/logs/wserv/access_logs_wasLCPROD.*]
blacklist = .gz
recursive = true
index = was_logs
sourcetype = ibm:was:app

[monitor:///appl_/logs/wserv/access_logs_wasCCLUAT.*]
blacklist = .gz
recursive = true
index = luat_was_logs
sourcetype = ibm:was:app

Bye.
Giuseppe

View solution in original post

0 Karma

siva_cg
Path Finder

It worked. Thank you cusello:)

0 Karma

siva_cg
Path Finder

Hi Giuseppe,

We have regular expression in the whitelist. The exact whitelist value is as below:
((access|error|access_ssl|error_ssl)log_was85CC[0-9]_A201_DigitalCA(IBC|IBR|DQMU)LUAT*[BW]1)?(|.\d{8}00)$

So will this regular expression be included in the monitor path? I will use a wildcard before this regular expression but just want to know whether we can include regular expression in the monitor path?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.