Getting Data In

multiple monitor for same directory

attgjh1
Communicator

I am attempting to read different types of log into various sources. But all the logs belong in the same directory and i cannot have multiple monitors in them

the various logs are located at desktop\test\

  1. pulsar_handler_machineid.2012-05-28-(hour)
  2. inbound_handler_machineid.2012-05-28-(hour)
  3. outbound_handler... etc

My initial attempt involved only using websplunk but i realised we cannot have more than one monitor on the same directory.

i tried with inputs.conf

[monitor://C:\Documents and Settings\attgjh1\Desktop\test\pulsar*]

disabled = false

followTail = 0

sourcetype = pulsar

the same settings were also created for the other logs.
however, splunk did not index any of the logs at all. (even after restarting)

im fairly new to using props.conf and inputs.conf to do stuffs.
can someone help me? thanks!

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

The monitor stanzas will be in inputs.conf and you can edit the file directly rather than use the UI but that should work as well. You could just use the following and splunk will monitor all files in that directory.

[monitor://C:Documents and Settings\attgjh1\Desktop\test]

You can also use wildcards
http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards

If there are files you don't want you can use a blacklist like this.

/#i want to ignore zipped files
blacklist = .(gz|bz2|z|zip)$

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

The monitor stanzas will be in inputs.conf and you can edit the file directly rather than use the UI but that should work as well. You could just use the following and splunk will monitor all files in that directory.

[monitor://C:Documents and Settings\attgjh1\Desktop\test]

You can also use wildcards
http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards

If there are files you don't want you can use a blacklist like this.

/#i want to ignore zipped files
blacklist = .(gz|bz2|z|zip)$

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...