monitor a directory that isn't always there

[vbumgarner]

I believe that if a directory mentioned in a monitor statement is not there when splunk starts up, the directory will never be tested for again. I believe.

I need to monitor a pair of clustered servers. When the service flips between servers, the drive containing the logs is unmapped from one server and mapped to the new server.

Assuming my initial belief is correct, is there a setting to tell Splunk to keep checking for the missing directory?

[amrit · Accepted solution]

Pretty sure that assumption is wrong. Permanently ignoring a directly monitored stanza would result in an assertion. 🙂