Getting Data In
Highlighted

splunk list monitor directories or files

Explorer

Hi,

When I execute command splunk list monitor: I see that there are two different types of monitoring: Monitored directories and Monitored Files.

For one specific monitored directory, does all the files of all the subfolders be monitored?
Thank you.

Tags (3)
Highlighted

Re: splunk list monitor directories or files

Champion

@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.

Example:


#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored. So splunk list monitor would not list them if they where not already indexed.
[monitor:\$SPLUNK_HOME\var\log\splunk]
ignoreOlderThan=2d
blacklist=metric

View solution in original post

0 Karma