Why is my regular expression in inputs.conf not working to monitor rotating log files?

[murthychitturi]

HI ,
I have below log files in the /repo/logs directory.

http_access_management_console_2016-04-25.log  
http_access_management_console_2016-04-26.log
http_access_management_console_2016-04-27.log
http_access_management_console_2016-04-28.log
http_access_management_console_2016-04-29.log
carbon.log
carbon.log.2016-04-27
carbon.log.2016-04-28
carbon.log.2016-04-29

http_access_management logs were recorded with dates for each day, where as carbon.log is today's log, and old dated logs are older logs.

to monitor http_access logs i am using the below command

./splunk add monitor /repository/logs/http_acce*.log -index hello -sourcetype esb-http-access-logs

and its throwing me the error
Parameters must be in the form -parameter value

and for carbon logs to monitor i am using the command

./splunk add monitor /repository/logs/wso2carbon.* -index hello -sourcetype esb-carbon-logs

and its also throwing me same issue.

Parameters must be in the form '-parameter value'

Was trying couple of different formats, nothing was working. Can someone help me on this?

[MuS · Accepted solution]

Did you try to quote the path like this:

 ./splunk add monitor '/repository/logs/http_acce*.log' -index hello -sourcetype esc-http-access-logs

cheers, MuS

[murthychitturi]

Thanks that worked for me. What is the command that will be used for me to monitor only the files for past 3 days and ignore the file before 3days. I used ignoreOlderThan = 3d , but still i can see the previous files in my splunk server.

[MuS]

Well, once indexed by splunk you will find these file until they age out of the index. The option ignoreOlderThan will work if you disable the monitor for 4 days and enable it again. After that you will only have the new data from the last three days, based on the modification date of the log file.

cheers, MuS