Getting Data In

Wildcard to monitor in inputs.conf

SS1
Path Finder

Hi,

I have below log files under path /path/to/app/

usera-x.log

userb-x.log

userc-x.log

userd-y.log

usere-y.log

userf-z.log

userg-z.log

.

.

etc

To extract *-x.log i am using below inputs.conf, but the data isnt being indexed into splunk. Is there any issue with my inputs.conf

[monitor://E:\path\to\app\*-x.log]
disabled = 0
index = test
sourcetype = metric

0 Karma

Vardhan
Contributor

Hi,

Can you try with below syntax.

[monitor://E:\path\to\app\*x.log]
disabled = 0
index = test
sourcetype = metric

verify the path properly and check the internal logs are coming from the forwarder or not? And also is there any error in the splunkd.log ? 

0 Karma

SS1
Path Finder
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart the forwarder after modifying inputs.conf?

---
If this reply helps you, Karma would be appreciated.
0 Karma

SS1
Path Finder

Yes, I have restarted the forwarder but no luck. I am wondering if *- is causing any problems?

0 Karma

DaClyde
Contributor

The * shouldn't be a problem.  We use it extensively in our monitor stanzas, both as parts of filenames and as path segments.  Has your test index already been created?

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...