Splunk Search

confused about wildcards in monitor in inputs.conf

milkovic
New Member

I have directories of logs organized as:

/opt/logjam/logs/nonprod/<service>.<environment>/<logs>

I am attempting to separate out the different environments into separate indexes.

i have the following two monitor stanzas:

# environment: UAT
[monitor:///opt/logjam/logs/nonprod/*uat/]
disabled = false
host_regex = prod/([^\.]*)
index = env_uat
sourcetype = log4j
whitelist = console.*|log$|out$

# environment: QUAL
[monitor:///opt/logjam/logs/nonprod/*qual/]
disabled = false
host_regex = prod/([^\.]*)
index = env_qual
sourcetype = log4j
whitelist = console.*|log$|out$

when I run splunk list monitor, I see:

Monitored Directories:
/opt/logjam/logs/nonprod/*uat/
    /opt/logjam/logs/nonprod/advisorportal01.devl
    /opt/logjam/logs/nonprod/advisorportal01.qual
    /opt/logjam/logs/nonprod/advisorportal01.test
    /opt/logjam/logs/nonprod/advisorportal01.uat
    /opt/logjam/logs/nonprod/advisorportal01.uat/catalina.2012-05-15.log
    /opt/logjam/logs/nonprod/advisorportal01.uat/catalina.2012-05-30.log
….

Monitored Files:
$SPLUNK_HOME/etc/splunk.version
/opt/logjam/logs/nonprod/*devl/
/opt/logjam/logs/nonprod/*qual/
/opt/logjam/logs/nonprod/*test/
/opt/logjam/logs/prod/*mirr/

which suggests that all of the files under /opt/logjam/logs/nonprod are getting lumped into the same index. Any help is appreciated.

Tags (1)
0 Karma

milkovic
New Member

I did a splunk clean eventdata and restarted. Although splunk list monitor still shows the files as associated with the first wildcard, it appears that the right thing is happening at the indexer. Doing some basic searches shows the correct files are ending up in the correct indexes, and there does not appear to be any pollution across the indexes.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...