Hello I have the below location to be monitored in a windows machine
D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\abclog.2019-02-17
D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\abclog.2019-02-17
This is the monitoring stanza I am assuming is correct which will take all folders log files like appzookeeper,backgrounder,terniation etc
[monitor://D:\Tab\Tableau Server\data\tabsvc\logs.*]
Thanks in advance
That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.
Try this:
[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
Hello Guys, I am new to splunk and need your help. I am also looking for same file monitoring to splunk cloud using splunk heavy forwarder. Can you tell what values did u used in input.conf ? or if you required to use regex to change some sort of transformation for getting into splunk.
That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.
Try this:
[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
Thank You!