Getting Data In

inputs.conf monitoring multiple folders

rahulg
Explorer

Hello there

i have inputs.conf

#[monitor:///opt/splunk/etc/apps/my_app/bin/out/.../*.gz]
#disabled=0
#index=security_my_index
#sourcetype=fzzz
#source=fdr
#interval=60

 

this is only indexing  all the files under

/opt/splunk/etc/apps/my_app/bin/out/data/**

 

but data is not getting indexed from below locations

/opt/splunk/etc/apps/my_app/bin/out/fdrv2/aidmaster

/opt/splunk/etc/apps/my_app/bin/out/fdrv2/managedassets

any idea on this?

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hİ @rahulg,

Is it possible that the filenames on those folders are not matching *.gz ?

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rahulg
Explorer

Now  i tried to chaneg inputs.conf

[monitor:///opt/splunk/etc/apps/my_app/bin/out/]

whitelist = \.gz$
recursive = true
disabled=0
index=security_my_index
sourcetype=fzzz
source=fdr
interval=60

looks like files are getting read but not indexed

i see logs 

INFO ArchiveProcessor - new tailer already processed path=

 

 

logs says

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...