Solved: Splunk Universal forwarder inputs.conf - Splunk Community

Getting Data In

Hi,

My issue is i need to monitor only 3 folders out of 9 folders is there any way that i can do this in the inputs.conf instead of adding all 3 folders and the files under them in separate monitor statements

ex:

Folder names are xxx1,xxx2,xxx3,......xxx9

i only need data from 1,2,3 folders , and multiple files under them

so in monitor statement in inputs.conf

/mnt/qa/xxx1/appslog/yyy/filename.log

instead of having statements for all 3 folders , can i do it one single monitor statement for all 3 folders if am monitoring files with same names under them ( by not including folders xxx4---xxx9

1 Solution

Solution

You could try something like the below. I think it might work. I have a blacklist version of that setup to skip certain folders under /var/log on some systems:

[monitor:///mnt/qa/]
whitelist = (xxx1|xxx2|xxx3)

Reference:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata

View solution in original post

Solution

You could try something like the below. I think it might work. I have a blacklist version of that setup to skip certain folders under /var/log on some systems:

[monitor:///mnt/qa/]
whitelist = (xxx1|xxx2|xxx3)

Reference:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata

Thanks starcher that helped me

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...