Getting Data In

monitoring a specific file through subdirectories

a212830
Champion

Hi,

How would I tell splunk to monitor a specific file through a set of subdirectories? Would I set a wildcard in the monitor statement? Should I use a whitelist?

0 Karma
1 Solution

starcher
Influencer

I would aim the monitor at the higher level common directory and whitelist.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata

Example:
[monitor:///data1/logs/]
whitelist = logfileyouwant.log

That should just grab that file name regardless where it shows up in all the different subdirectories under /data1/logs/

View solution in original post

starcher
Influencer

I would aim the monitor at the higher level common directory and whitelist.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata

Example:
[monitor:///data1/logs/]
whitelist = logfileyouwant.log

That should just grab that file name regardless where it shows up in all the different subdirectories under /data1/logs/

Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...