Splunk Universal forwarder inputs.conf

[ajaybguthi]

Hi,

My issue is i need to monitor only 3 folders out of 9 folders is there any way that i can do this in the inputs.conf instead of adding all 3 folders and the files under them in separate monitor statements

ex:

Folder names are xxx1,xxx2,xxx3,......xxx9

i only need data from 1,2,3 folders , and multiple files under them

so in monitor statement in inputs.conf

/mnt/qa/xxx1/appslog/yyy/filename.log

instead of having statements for all 3 folders , can i do it one single monitor statement for all 3 folders if am monitoring files with same names under them ( by not including folders xxx4---xxx9

[starcher · Accepted solution]

You could try something like the below. I think it might work. I have a blacklist version of that setup to skip certain folders under /var/log on some systems:

[monitor:///mnt/qa/]
whitelist = (xxx1|xxx2|xxx3)

Reference:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata

[ajaybguthi]

Thanks starcher that helped me