Splunk Search

Cannot search log that is configured on forwarder using wildcard

Isaias_Garcia
Path Finder

I configured my forwarder as :

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]
disabled = false
followTail = 0
host = sumosamprd76
index = prd
sourcetype = sumologs

But why is it I cannot search the logs under "logger/simlog.log" logfile when I ran the below query? Is there something wrong in configuring forwarder with wild card (i.e asterisk)?

source=/sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/logger/simlog.log

Please help. thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

monitor is specified.

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/*.log]

(EX.)
To monitor any file directly under /apache/ that ends in .log:
[monitor:///apache/*.log]

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards

Be considered as a reason you can not search
1. Has not been taken up log
2. INDEX of interest is not the default search
→ Please add "index = prd" in the search condition.
3. Is wrong specified SOURCE

View solution in original post

0 Karma

HiroshiSatoh
Champion

monitor is specified.

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/*.log]

(EX.)
To monitor any file directly under /apache/ that ends in .log:
[monitor:///apache/*.log]

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards

Be considered as a reason you can not search
1. Has not been taken up log
2. INDEX of interest is not the default search
→ Please add "index = prd" in the search condition.
3. Is wrong specified SOURCE

0 Karma

Isaias_Garcia
Path Finder

cheers! thanks

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...