Splunk forwarder on linux: parameter format error after adding monitor

[thambisetty]

Hi,
I have installed splunk forwarder on linux which is having symantec Brightmail Gateway.
and i tried to forward the data from that machine to splunk indexer that forwarder sending data only one file under the folder.
The path which i have given while adding the monitor:
'/var/log/mail/symantec/inbound'
under the inbound i want to read everything which has extension of type '.gz'
i am getting error that is "parameter should be in this format '-parameter value' "
while try to give the path like '/var/log/mail/symantec/inbound/*.gz'
can anyone tell me why its happening like that
please.......

[Ayn · Accepted solution]

If you're adding things from the CLI, you need to make sure that your shell is not expanding wildcards for you. If you do

splunk add monitor /var/log/mail/symantec/inbound/*.gz

Your shell will expand this into all files that match that. In order to prevent that from happening you need to escape it, for instance by putting it in single quotes.

splunk add monitor '/var/log/mail/symantec/inbound/*.gz'

[thambisetty]

now i want to remove that which i added to monitor earlier.
May i konw how to do that.again i will add to monitor as u said

[MuS]

Like the add command there is a remove command to remove monitor:

splunk remove monitor '/var/log/mail/symantec/inbound/*.gz'

cheers, MuS