I have the following confs
inputs:
[monitor:///opt/logs/\*.prd/\*/\*EndAudit.csv]
disable = false
index = foo
props:
[source::/opt/logs/\*bfc.sv.prd/\*/HttpConnectorService-\*-FrontEndAudit.csv]
sourcetype = HttpConFramework-FrontEnd-BFC
priority = 101
[source::/opt/logs/\*bfc.sv.prd/\*/HttpConnectorService-\*-BackEndAudit.csv]
sourcetype = HttpConFramework-BackEnd-BFC
priority = 101
these 2 sources are not getting their sourcetype set properly as defined above in the props
if I run ./splunk test sourcetype /opt/logs/symbfc.sv.prd/symbfc111/HttpConnectorService-11.02-FrontEndAudit.csv
Using logging configuration at /opt/instance/splunk/etc/log-cmdline.cfg.
PROPERTIES OF /opt/logs/symbfc.sv.prd/symbfc111/HttpConnectorService-11.02-FrontEndAudit.csv
<snip>
Attr:sourcetype HttpConFramework-FrontEnd-BFC
</snip>
however running:
./splunk test sourcetype /opt/logs/\*bfc.sv.prd/\*/HttpConnectorService-\*-FrontEndAudit.csv
Command error: The argument '/opt/logs/symbfc.sv.prd/symbfc111/HttpConnectorService-11.02-FrontEndAudit.csv' is invalid. Arguments must be specified in the form '-argument value'.
Are there actually wildcard's in your file names? If not you probably don't wan't a string literal wildcard
\*
## inputs.conf
## The ellipsis (...) wildcard recurses through directories and any
## number of levels of subdirectories to find matches.
## The asterisk wildcard matches anything in that specific directory path segment.
[monitor:///opt/logs/*.prd/.../*EndAudit.csv]
disable = false
index = foo
## props.conf
[source::/opt/logs/*.prd/.../*FrontEndAudit.csv]
sourcetype = HttpConFramework-FrontEnd-BFC
priority = 101
[source::/opt/logs/*.prd/.../*BackEndAudit.csv]
sourcetype = HttpConFramework-BackEnd-BFC
priority = 101