What could be the stanza for monitoring linux directory?

[ujju219]

what could be the stanza for monitoring linux directory 

/home/cleo/Harmony/script/logs/Harmony_directory_monitor_1hr.conf.20220512.log

i tried [monitor:///home/cleo/Harmony/script/logs] with whitelist =*.log

but not able to ingest any data. this path has proper permission. 

[gcusello]

Hi @ujju219,

please try this:

[monitor:///home/cleo/Harmony/script/logs/]

and, if not working, try:

[monitor:///home/cleo/Harmony/script/logs/*.log]

I suppose that you restarted Splunk on the Universal Forwarder after modifying.

Ciao.

Giuseppe

[ujju219 · Accepted solution]

@gcusello  Thanks for the help. It worked. There was also some issue with Intermediate forwarder as well, after restarting UF on Intermediate forwarder data get ingested.

[gcusello]

Hi @ujju219,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉