Wildcards in source name in inputs.conf

[jpashak]

We are monitoring log files that rotate multiple times daily.  We have wildcards specified in the monitor command, but do not in the source command.  Our issue arises when the software that generates the logs is updated and we have to update the paths in our inputs.conf.

Here is a sample stanza:

[monitor:///apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV_*]
index=peoplesoft
sourcetype=peoplesoft_appsrv
source=/apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV.LOG

What we would like to do is something along these lines so version changes don't require Splunk changes:

[monitor:///apps/psprd*/.../APPSRV_*]
index=peoplesoft
sourcetype=peoplesoft_appsrv
source=/apps/psprd*/.../APPSRV.LOG

I have notes from my predecessor that we can't do that because you cannot specify a wildcard on the source line.  We want the full pathname for the source.

Is this limitation still in effect or can it be done?

Thanks In Advance!

Jeff

[richgalloway]

Leave out the source specifier.  Splunk will get the source value from the file it reads.

[jpashak]

I understand that.  In our case, we want the source to not contain the changing value in the filename, to give the appearance the source is the same for all of these. 

Example:

The file name is /apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV_0908.LOG

We want the source to be

         /apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV.LOG

not /apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV_0908.LOG