Getting Data In

how to configure splunk forwarder to monitor a file whose name changes on daily basis

poddraj
Explorer

Hi All,

I am trying to monitor a logfile which is generated in a path every day at 23:55 from a python script. My problem here is the file name of the log file changes everyday as the script is appending date to the file name.

Eg: Today the file name is "eswitch_16122019_235501_7000.log"
Tomorrow the file name will be "eswitch_17122019_235501_7000.log"

My inputs.conf is as below
[monitor:///opt/home/splunk_eswitch/eswitch_*.log]
disabled = false
index = test2
sourcetype = eswitch

Now when I run splunk list monitor I am seeing a below
/opt/home/splunk_eswitch/eswitch_*.log
/opt/delphi/splunk_eswitch/eswitch_16122019_235501_7000.log

My question is tomorrow does the forwarder sends the newly created file log to indexer with any issue as the yesterday's file will not be present in the same path.
Is there any better regex to have in inputs.conf then above one

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your inputs.conf looks good. The forwarder will notice the new file when it is created and will monitor it. Moving the old file to a new location should not affect the forwarder.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your inputs.conf looks good. The forwarder will notice the new file when it is created and will monitor it. Moving the old file to a new location should not affect the forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...