Getting Data In

Why is my regular expression in inputs.conf not working to monitor rotating log files?

New Member

HI ,
I have below log files in the /repo/logs directory.

http_access_management_console_2016-04-25.log  
http_access_management_console_2016-04-26.log
http_access_management_console_2016-04-27.log
http_access_management_console_2016-04-28.log
http_access_management_console_2016-04-29.log
carbon.log
carbon.log.2016-04-27
carbon.log.2016-04-28
carbon.log.2016-04-29

httpaccessmanagement logs were recorded with dates for each day, where as carbon.log is today's log, and old dated logs are older logs.

to monitor http_access logs i am using the below command

./splunk add monitor /repository/logs/http_acce*.log -index hello -sourcetype esb-http-access-logs

and its throwing me the error
Parameters must be in the form -parameter value

and for carbon logs to monitor i am using the command

./splunk add monitor /repository/logs/wso2carbon.* -index hello -sourcetype esb-carbon-logs

and its also throwing me same issue.

Parameters must be in the form '-parameter value'

Was trying couple of different formats, nothing was working. Can someone help me on this?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Did you try to quote the path like this:

 ./splunk add monitor '/repository/logs/http_acce*.log' -index hello -sourcetype esc-http-access-logs

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Did you try to quote the path like this:

 ./splunk add monitor '/repository/logs/http_acce*.log' -index hello -sourcetype esc-http-access-logs

cheers, MuS

View solution in original post

New Member

Thanks that worked for me. What is the command that will be used for me to monitor only the files for past 3 days and ignore the file before 3days. I used ignoreOlderThan = 3d , but still i can see the previous files in my splunk server.

0 Karma

SplunkTrust
SplunkTrust

Well, once indexed by splunk you will find these file until they age out of the index. The option ignoreOlderThan will work if you disable the monitor for 4 days and enable it again. After that you will only have the new data from the last three days, based on the modification date of the log file.

cheers, MuS

0 Karma