Splunk Enterprise

How to write inputs.conf to Monitor files in a directory which is dynamic?

sarahnazzar
Explorer

Hi All,

I want to monitor files which keeps changing the filename according to the current date falling under respective month and year directory. Can anyone please help me out how can we monitor the same. I tried using wild card in the inputs.conf, but it seems to be not working.

Format:

D:\Logs\<dynamic-year>\<dynamic-month>\<dynamic-date>.txt

D:\Logs\2022\04\21042022.txt

I used the below config under inputs.conf

[monitor://D:\Logs\*\*\*.txt]
disabled = true
crcSalt = <SOURCE>
index = indexname
sourcetype = sourcetypename

 

Many Thanks in Advance! 

 

Labels (2)
Tags (2)
0 Karma
1 Solution

smurf
Communicator

"The asterisk wildcard matches anything in that specific folder path segment.

Unlike ..., * does not recurse through subfolders.".

You can read more about it in the docs: Specify input paths with wildcards - Splunk Documentation

 

I think your stanza should be working without that typo, but if it doesn't I would try (...).

I also noticed that you have disabled = true. If you want it active, it should be false.

 

View solution in original post

0 Karma

smurf
Communicator

Hi,

I think your stanza should work with a small change - removing the double backslash

[monitor://D:\Logs\*\*\*.txt]

 I personally would use ... like this:

[monitor://D:\Logs\...\*.txt]
0 Karma

sarahnazzar
Explorer

Hi @smurf 

Thanks for your response!

Apologies.. double slash was a typo, you mean just period (...) instead of wildcard and backslash (*\*)?

[monitor://D:\Logs\...\*.txt]

 

0 Karma

smurf
Communicator

"The asterisk wildcard matches anything in that specific folder path segment.

Unlike ..., * does not recurse through subfolders.".

You can read more about it in the docs: Specify input paths with wildcards - Splunk Documentation

 

I think your stanza should be working without that typo, but if it doesn't I would try (...).

I also noticed that you have disabled = true. If you want it active, it should be false.

 

0 Karma

sarahnazzar
Explorer

Many thanks @smurf  this worked!! 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...