Splunk Search

Parsing custom log names into different indexes. Same folder.

Explorer

My question has to deal with regex and the inputs.conf. It's new to me so I'm taking it slow. We have all of our custom app logs dumped into a '//inHouseLogs/' folder on our servers. Right now I'm attempting to split these logs into indexes for each program. Basically the file structure in the folder looks like this:

ProgramOne.exe.45624.1.username1.log.log
ProgramOne.exe.56782.1.username2.log.log
ProgramOne.exe.45624.1.username1.log.log.1
ProgramOne.exe.45624.1.username1.log.log.2
ProgramTwo.exe.95862.1.username3.log.log
ProgramTwo.exe.95862.1.username3.log.log.1

ProgramThree.exe.85645.1.username4.log.log

And here is how I have the inputs.conf on the universal forwarder (\\SplunkUniversalForwarder\etc\system\local) setup for it:

[default]
host = server001

[monitor://c:\inHouseLogs\ProgramOne(.*)/.log$(.*)]
disabled = false
sourcetype = programOne_logs
index = programOne

[monitor://c:\inHouseLogs\ProgramTwo(.*)/.log$(.*)]
disabled = false
sourcetype = programTwo_logs
index = programTwo

[WinEventLog:Application]
disabled = 0
start_from = newest
index = system

[WinEventLog:System]
disabled = 0
current_only = 1
index = system

================================

Does this good or am I doing something wrong? Also should I be editing the indexes.conf in \etc\system\local in or \etc\apps\search\local

0 Karma

Splunk Employee
Splunk Employee

Nelsonbarringer,
The regexes on the monitor header may not do what you want to do. The asterisk (*) matches anything in a single path segment while "..." will recurse through directories.

I think you'd be better off using whitelist and blacklist under your monitor stanzas.

Check here for more info on white/blacklisting: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!