Getting Data In

splunk uf not reading logs

AzmathShaik
Path Finder

hellowe’ve directory structure as follows
/apps/ftp/user/logs/admin -- main directory
sub-directories
2018 2019 2020
and further more each sub-directory with year has directories with months as
01 02 02 03 04 05 06 07 08 09 10
under months directories we have csv log filesso to access a csv file for today
/apps/ftp/user/logs/admin/2020/10/20201008.csvhere is monitor stanza for to read this file
[monitor:///apps/*/user/logs/admin/.../.../*.csv]
disabled = false
sourcetype = csv
index= user-access-logs
crcSalt = <SOURCE>but it’s not reading logs and no error in splunkd logs. can someone help me in correcting the monitor stanza if i’ve done mistake

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you try to replace .../... with ... as ... means any number of subdirectories. Other option is replace it with */*
r. Ismo
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!