Windows Monitoring Stanza help

[vrmandadi]

Hello I have the below location to be monitored in a windows machine

D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\abclog.2019-02-17

D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\abclog.2019-02-17

This is the monitoring stanza I am assuming is correct which will take all folders log files like appzookeeper,backgrounder,terniation etc

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs.*]

Thanks in advance

[sahilverma]

Hello Guys, I am new to splunk and need your help. I am also looking for same file monitoring to splunk cloud using splunk heavy forwarder. Can you tell what values did u used in input.conf ? or if you required to use regex to change some sort of transformation for getting into splunk.

[richgalloway · Accepted solution]

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]

[vrmandadi]

Thank You!