I'm facing a problem with writing a stanza that would collect log files from a directory tree. The tree is (example):
I wish to grab the .log files from the tree.
Thus I wrote into inputs.conf:
This isn't really working. In fact, I've tried several ways, none are working (just two examples below):
[MonitorNoHandle://D:\Log\App\...] whitelist = \\*\.log$ [MonitorNoHandle://D:\Log\App\Module\Log] whitelist = \\*\.log$
I'm also placing below the above:
disabled = 0 index = test sourcetype = app-log
Please help with the stanza wildcards?!
I've read several posts on the forums already, not mentioning the documentation, and this doesn't seem to work.
There are no obvious errors (log_level > info) when monitoring after
splunk reload deploy-server, the app is downloaded to the folders... but the logs are not coming in.
Thank you 🙂
So, I've not noticed that [MonitorNoHandle] is apparently meant for single file, while [monitor] is spelled lower case.
In the end, what worked for me was:
whitelist = \*.log$
disabled = 0
sourcetype = APP-Trace.log
[monitor://D:\Log\APP\*\PerformanceLogs\...] whitelist = \\*\.log$ disabled = 0 sourcetype = APP-PerformanceLogs.log
Thank you sir!