Getting Data In

Windows Monitoring Stanza help

vrmandadi
Builder

Hello I have the below location to be monitored in a windows machine

D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\abclog.2019-02-17

D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\abclog.2019-02-17

This is the monitoring stanza I am assuming is correct which will take all folders log files like appzookeeper,backgrounder,terniation etc

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs.*]

Thanks in advance

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

sahilverma
Loves-to-Learn

Hello Guys, I am new to splunk and need your help. I am also looking for same file monitoring to splunk cloud using splunk heavy forwarder. Can you tell what values did u used in input.conf ? or if you required to use regex to change some sort of transformation for getting into splunk.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

vrmandadi
Builder

Thank You!

0 Karma