Getting Data In

Windows Monitoring Stanza help

vrmandadi
Builder

Hello I have the below location to be monitored in a windows machine

D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\appzookeeper\abclog.2019-02-17

D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\xyz.log
D:\Tab\Tableau Server\data\tabsvc\logs\backgrounder\abclog.2019-02-17

This is the monitoring stanza I am assuming is correct which will take all folders log files like appzookeeper,backgrounder,terniation etc

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs.*]

Thanks in advance

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
---
If this reply helps you, Karma would be appreciated.

View solution in original post

sahilverma
Loves-to-Learn

Hello Guys, I am new to splunk and need your help. I am also looking for same file monitoring to splunk cloud using splunk heavy forwarder. Can you tell what values did u used in input.conf ? or if you required to use regex to change some sort of transformation for getting into splunk.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That monitor stanza will look for files in the tabsvc directory with base name of 'logs' with any extension. It doesn't match your sample file names.

Try this:

[monitor://D:\Tab\Tableau Server\data\tabsvc\logs\*\*log*]
---
If this reply helps you, Karma would be appreciated.

vrmandadi
Builder

Thank You!

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...