File monitor wildcard not matching?

[jdmclemore]

I'm trying to monitor a catalina logs that look like this:

/home/loader/logs/catalina.2017-09-01.log

with this file monitor stanza:

[monitor:///home/loader/logs/catalina.*.log]
disabled = false
sourcetype = catalina

But I'm not seeing any data. Any reason why that wildcard would not match that file?

[burwell · Accepted solution]

1. Like Woodcock suggests, be sure you have index=main on your search
2. For a quick search, change the time period to All Time. Perhaps you are having time parsing issues. Oftentimes I find my data is in Splunk. I am just looking in the wrong time interval.
3. Look in the forwarder logs when you restart Splunk and make sure that the forwarder is monitoring the directory you expect
4. Check to make sure that the user who runs Splunk can read the logs.

[jdmclemore]

Thanks for the suggestions...turned out to be user error. 🙂 My wildcard DID match the file name.

[woodcock]

You haven't told it what index to go to. Try this for a test:

[monitor:///home/loader/logs/catalina.*.log]
disabled = false
sourcetype = catalina
index = main

[ddrillic]

It should. For sanity check, I would put [monitor:///home/loader/logs/catalina.2017-09-01.log] if you haven't done it yet... index=main?