Getting Data In

splunk list monitor directories or files

lqiao
Explorer

Hi,

When I execute command splunk list monitor: I see that there are two different types of monitoring: Monitored directories and Monitored Files.

For one specific monitored directory, does all the files of all the subfolders be monitored?
Thank you.

Tags (3)
1 Solution

bmacias84
Champion

@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.

Example:


#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored. So splunk list monitor would not list them if they where not already indexed.
[monitor:\$SPLUNK_HOME\var\log\splunk]
ignoreOlderThan=2d
blacklist=metric

View solution in original post

0 Karma

bmacias84
Champion

@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.

Example:


#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored. So splunk list monitor would not list them if they where not already indexed.
[monitor:\$SPLUNK_HOME\var\log\splunk]
ignoreOlderThan=2d
blacklist=metric

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!