Getting Data In

What is the proper syntax for my forwarder inputs.conf stanza to monitor specific files based on a string in the filename?

andrefriedmann
New Member

Hi

I am trying to monitor specific files from one directory based on a string in the filename.

Example files:

C:\testapp\logs\02-05-2014 Logins.log
C:\testapp\logs\04-06-2014 Audits.log

There will be daily login and audit files, however, I only want to monitor the files with logins. Everything I have tried so far either forward nothing or all files! Any help much appreciated.

Last thing I tried was:

[monitor://C:\testapp\logs\[0-9-]+\sSvcLogins.log]

Thanks

0 Karma
1 Solution

tlelle_splunk
Splunk Employee
Splunk Employee

Have you tried just the basic :

[monitor://C:\testapp\logs\*Logins.log]

In your case, this should work.

For reference:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Specifyinputpathswithwildcards

View solution in original post

tlelle_splunk
Splunk Employee
Splunk Employee

Have you tried just the basic :

[monitor://C:\testapp\logs\*Logins.log]

In your case, this should work.

For reference:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Specifyinputpathswithwildcards

andrefriedmann
New Member

Hi

Yes, and I was sure I had previously tried something very similar!! but that worked

Thanks for your help

0 Karma

tlelle_splunk
Splunk Employee
Splunk Employee

Were you able to try this out?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...