Splunk Search

inputs.conf wildcards and whitelist question

minthu
New Member

i would like to monitor the following in different sourcetypes, but doesnt seem to get the whitelist correct
there will be other different folders and search just does not go to these other folders
/var/logs/.../mq-e*
/var/logs/.../err-*
/var/logs/.../warn-*
/var/logs/.../*

/var/logs/DNS/SU3000/WDNSAH8700/mq-eWDNSAH8700.log.th
in messagequeue

/var/logs/DNS/SU3000/WDNSAH8700/err-WDNSAH8700.log.th
in errorlog

/var/logs/DNS/SU3000/WDNSAH8700/warn-WDNSAH8700.log.th
in warninglog

/var/logs/DNS/SU3000/WDNSAH8700/WDNSAH8700.log.th
in mainlog

i tried different monitor stanza but nothing gives me the correct logging.

[monitor:///var/logs]
whitelist ="mq-e*.log.*"
sourcetype = messagequeue
index = unix

and tried [monitor:///var/logs/.../mq-s*.log.*] without whitelist, also did not work.

can someone please enlighten me?
appreciate it if anyone could point me to some material to learn about wildcard and whitelist syntaxes as well.

Tags (2)
0 Karma

aholzel
Communicator

Not sure if this is the problem but if you have a look at the inputs.conf documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

It says about whitelist:

whitelist = <regular expression>
 * If set, files from this input are monitored only if their path matches the specified regex.
 * Takes precedence over the deprecated _whitelist attribute, which functions the same way.

So it think that the whitelist needs to be something like:

whitelist = .mq-e.*log.

0 Karma

minthu
New Member

hello,

it works on single sourcetype but when i have multiple sourcetypes it only monitors the first one.


[monitor:///var/logs/]
recursive=true
whitelist =.mq-s.
sourcetype = messagequeue
index = automation
disabled=0
[monitor:///var/logs/]
recursive=true
whitelist =.err.
sourcetype = errlog
index = automation
disabled=0

not sure how we can use different sourcetypes for the same sub folders

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...