how to configure inputs.conf?

[khandelwaly]

i have logs like this :

-rw-r----- 1 jira jira 4921534 Apr 13 22:42 catalina.2020-04-13.log
-rw-r----- 1 jira jira 463769261 Apr 14 00:00 access_log.2020-04-13
-rw-r----- 1 jira jira 2840014 Apr 14 13:08 catalina.2020-04-14.log
-rw-r----- 1 jira jira 222675515 Apr 14 13:08 access_log.2020-04-14

How to configure inputs.conf for the access_log
I tried below but it didnot work

[monitor:////apps/logs/access_log]
index = prdidx
blacklist = .(gz)$
sourcetype = ACCESS
_TCP_ROUTING = WEB

[richgalloway]

Try

[monitor:///apps/logs/access_log/access_log.*]

[khandelwaly]

logs file name is access_log.2020-04-14. No folder with name access_log.
Tried without access_log folder as well but it didnot work

[richgalloway]

Did you restart the forwarder after changing inputs.conf?
Does Splunk have read access to the logs?
Do the files appear in the output of the CLI command splunk list monitor?

[PavelP]

if splunk runs as not root user then you have to add splunk to jira group, here is an example if splunk(forwarder) runs as a splunk user:

usermod -a -G jira splunk

[khandelwaly]

Splunk restart is fine. Only files under the mentioned directory is not shown on Splunk. Need help to configure the inputs.conf

[PavelP]

Does splunk run as a root user?

[khandelwaly]

yes it run as root.

[to4kawa]

# The following configuration reads all the files in the directory /var/log.

[monitor:///var/log]

there is too many /

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

[khandelwaly]

I removed the / but still the same thing. I don't want to read all the files in that directory. I want to only read access_log

[khandelwaly]

Tried below but still failing
[monitor:///apps/logs/]
index = prdidx
blacklist = \.(gz)$
whitelist = access_log\.*$
sourcetype =ACCESS
_TCP_ROUTING = WEB

[to4kawa]

blacklist = .(gz)$
→
whitelist = \.log$
How about this?

[khandelwaly]

Files are not ending with .log. Tried _log but did not work

[to4kawa]

what's your sourcetype now?

[to4kawa]

https://docs.splunk.com/Documentation/Splunk/8.0.3/Troubleshooting/Cantfinddata

[to4kawa]

and check sourcetype

[richgalloway]

What is the full path of the log files shown?

[khandelwaly]

files are under /apps/logs/