Getting Data In

Splunk forwarder on linux: parameter format error after adding monitor

thambisetty
SplunkTrust
SplunkTrust

Hi,
I have installed splunk forwarder on linux which is having symantec Brightmail Gateway.
and i tried to forward the data from that machine to splunk indexer that forwarder sending data only one file under the folder.
The path which i have given while adding the monitor:
'/var/log/mail/symantec/inbound'
under the inbound i want to read everything which has extension of type '.gz'
i am getting error that is "parameter should be in this format '-parameter value' "
while try to give the path like '/var/log/mail/symantec/inbound/*.gz'
can anyone tell me why its happening like that
please.......

————————————
If this helps, give a like below.
Tags (3)
0 Karma
1 Solution

Ayn
Legend

If you're adding things from the CLI, you need to make sure that your shell is not expanding wildcards for you. If you do

splunk add monitor /var/log/mail/symantec/inbound/*.gz

Your shell will expand this into all files that match that. In order to prevent that from happening you need to escape it, for instance by putting it in single quotes.

splunk add monitor '/var/log/mail/symantec/inbound/*.gz'

View solution in original post

Ayn
Legend

If you're adding things from the CLI, you need to make sure that your shell is not expanding wildcards for you. If you do

splunk add monitor /var/log/mail/symantec/inbound/*.gz

Your shell will expand this into all files that match that. In order to prevent that from happening you need to escape it, for instance by putting it in single quotes.

splunk add monitor '/var/log/mail/symantec/inbound/*.gz'

thambisetty
SplunkTrust
SplunkTrust

now i want to remove that which i added to monitor earlier.
May i konw how to do that.again i will add to monitor as u said

————————————
If this helps, give a like below.
0 Karma

MuS
SplunkTrust
SplunkTrust

Like the add command there is a remove command to remove monitor:

splunk remove monitor '/var/log/mail/symantec/inbound/*.gz'

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...