Getting Data In

splunk uf not reading logs

AzmathShaik
Path Finder

hellowe’ve directory structure as follows
/apps/ftp/user/logs/admin -- main directory
sub-directories
2018 2019 2020
and further more each sub-directory with year has directories with months as
01 02 02 03 04 05 06 07 08 09 10
under months directories we have csv log filesso to access a csv file for today
/apps/ftp/user/logs/admin/2020/10/20201008.csvhere is monitor stanza for to read this file
[monitor:///apps/*/user/logs/admin/.../.../*.csv]
disabled = false
sourcetype = csv
index= user-access-logs
crcSalt = <SOURCE>but it’s not reading logs and no error in splunkd logs. can someone help me in correcting the monitor stanza if i’ve done mistake

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you try to replace .../... with ... as ... means any number of subdirectories. Other option is replace it with */*
r. Ismo
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...