Splunk Search
Highlighted

Wildcard not working in monitor input

Explorer

I used following syntax to monitor a file input in windows
[monitor://D:\app\logs\a.log]
The above stanza is not indexing any file. Getting the below error in splnkd.log on forwarder
FilesystemChangeWatcher - error getting attributes of path "\D:": The filename, directory name, or volume label syntax is incorrect.

But when I use following input, it works.
[monitor://D:\appdev\logs\a*.log]

Please help.

0 Karma
Highlighted

Re: Wildcard not working in monitor input

Path Finder

Hi,

can you try this

 [monitor://D:\app*\log\]
 index = <your_index>
 sourcetype = <your_sourcetype>
 whitelist = a*\.log$

See also: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

0 Karma
Highlighted

Re: Wildcard not working in monitor input

Explorer

Thanks for the reply.
It's not working. The reason is that I provided wildcard just after the drive D:\app\log. when we provide an input like following, it works.
[monitor://D:\appdev\l
]

Please confirm if there is any other way to provide wildcard to a folder after D:\

0 Karma
Highlighted

Re: Wildcard not working in monitor input

Path Finder

well

you can also play with the path, can you change the directory to something like D:\newdir\appxxx and then recursively monitor the newdir ?

  [monitor://D:\...\log\a*.log]
  whitelist =  D:\app*\

see also https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Specifyinputpathswithwildcards

0 Karma
Highlighted

Re: Wildcard not working in monitor input

Explorer

No, we cannot change the directory as it is on forwarder and it is generated by an application.

0 Karma
Highlighted

Re: Wildcard not working in monitor input

Esteemed Legend

Try this:

[monitor://D:\*\log\a*.log]
whitelist = D:\app*\log\a*.log
0 Karma
Highlighted

Re: Wildcard not working in monitor input

Explorer

Hi, Thanks for the reply.
The wildcard just after the root directory is not working in Splunk. Could you please check at your end if this works?

0 Karma