Splunk Search

Cannot search log that is configured on forwarder using wildcard

Isaias_Garcia
Path Finder

I configured my forwarder as :

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]
disabled = false
followTail = 0
host = sumosamprd76
index = prd
sourcetype = sumologs

But why is it I cannot search the logs under "logger/simlog.log" logfile when I ran the below query? Is there something wrong in configuring forwarder with wild card (i.e asterisk)?

source=/sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/logger/simlog.log

Please help. thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

monitor is specified.

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/*.log]

(EX.)
To monitor any file directly under /apache/ that ends in .log:
[monitor:///apache/*.log]

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards

Be considered as a reason you can not search
1. Has not been taken up log
2. INDEX of interest is not the default search
→ Please add "index = prd" in the search condition.
3. Is wrong specified SOURCE

View solution in original post

0 Karma

HiroshiSatoh
Champion

monitor is specified.

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]

[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/*.log]

(EX.)
To monitor any file directly under /apache/ that ends in .log:
[monitor:///apache/*.log]

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards

Be considered as a reason you can not search
1. Has not been taken up log
2. INDEX of interest is not the default search
→ Please add "index = prd" in the search condition.
3. Is wrong specified SOURCE

0 Karma

Isaias_Garcia
Path Finder

cheers! thanks

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...