Splunk Search

confused about wildcards in monitor in inputs.conf

milkovic
New Member

I have directories of logs organized as:

/opt/logjam/logs/nonprod/<service>.<environment>/<logs>

I am attempting to separate out the different environments into separate indexes.

i have the following two monitor stanzas:

# environment: UAT
[monitor:///opt/logjam/logs/nonprod/*uat/]
disabled = false
host_regex = prod/([^\.]*)
index = env_uat
sourcetype = log4j
whitelist = console.*|log$|out$

# environment: QUAL
[monitor:///opt/logjam/logs/nonprod/*qual/]
disabled = false
host_regex = prod/([^\.]*)
index = env_qual
sourcetype = log4j
whitelist = console.*|log$|out$

when I run splunk list monitor, I see:

Monitored Directories:
/opt/logjam/logs/nonprod/*uat/
    /opt/logjam/logs/nonprod/advisorportal01.devl
    /opt/logjam/logs/nonprod/advisorportal01.qual
    /opt/logjam/logs/nonprod/advisorportal01.test
    /opt/logjam/logs/nonprod/advisorportal01.uat
    /opt/logjam/logs/nonprod/advisorportal01.uat/catalina.2012-05-15.log
    /opt/logjam/logs/nonprod/advisorportal01.uat/catalina.2012-05-30.log
….

Monitored Files:
$SPLUNK_HOME/etc/splunk.version
/opt/logjam/logs/nonprod/*devl/
/opt/logjam/logs/nonprod/*qual/
/opt/logjam/logs/nonprod/*test/
/opt/logjam/logs/prod/*mirr/

which suggests that all of the files under /opt/logjam/logs/nonprod are getting lumped into the same index. Any help is appreciated.

Tags (1)
0 Karma

milkovic
New Member

I did a splunk clean eventdata and restarted. Although splunk list monitor still shows the files as associated with the first wildcard, it appears that the right thing is happening at the indexer. Doing some basic searches shows the correct files are ending up in the correct indexes, and there does not appear to be any pollution across the indexes.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...