Getting Data In

Windows Monitoring Stanza help

vrmandadi
Builder

Hello I have the below location to be monitored in a windows machine

D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\abclog.2019-02-17

D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\abclog.2019-02-17

This is the monitoring stanza I am assuming is correct which will take all folders log files like appzookeeper,backgrounder,terniation etc

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs.*]

Thanks in advance

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

sahilverma
Loves-to-Learn

Hello Guys, I am new to splunk and need your help. I am also looking for same file monitoring to splunk cloud using splunk heavy forwarder. Can you tell what values did u used in input.conf ? or if you required to use regex to change some sort of transformation for getting into splunk.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
---
If this reply helps you, Karma would be appreciated.

vrmandadi
Builder

Thank You!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...