Splunk Search

inputs.conf wildcards and whitelist question

minthu
New Member

i would like to monitor the following in different sourcetypes, but doesnt seem to get the whitelist correct
there will be other different folders and search just does not go to these other folders
/var/logs/.../mq-e*
/var/logs/.../err-*
/var/logs/.../warn-*
/var/logs/.../*

/var/logs/DNS/SU3000/WDNSAH8700/mq-eWDNSAH8700.log.th
in messagequeue

/var/logs/DNS/SU3000/WDNSAH8700/err-WDNSAH8700.log.th
in errorlog

/var/logs/DNS/SU3000/WDNSAH8700/warn-WDNSAH8700.log.th
in warninglog

/var/logs/DNS/SU3000/WDNSAH8700/WDNSAH8700.log.th
in mainlog

i tried different monitor stanza but nothing gives me the correct logging.

[monitor:///var/logs]
whitelist ="mq-e*.log.*"
sourcetype = messagequeue
index = unix

and tried [monitor:///var/logs/.../mq-s*.log.*] without whitelist, also did not work.

can someone please enlighten me?
appreciate it if anyone could point me to some material to learn about wildcard and whitelist syntaxes as well.

Tags (2)
0 Karma

aholzel
Communicator

Not sure if this is the problem but if you have a look at the inputs.conf documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

It says about whitelist:

whitelist = <regular expression>
 * If set, files from this input are monitored only if their path matches the specified regex.
 * Takes precedence over the deprecated _whitelist attribute, which functions the same way.

So it think that the whitelist needs to be something like:

whitelist = .mq-e.*log.

0 Karma

minthu
New Member

hello,

it works on single sourcetype but when i have multiple sourcetypes it only monitors the first one.


[monitor:///var/logs/]
recursive=true
whitelist =.mq-s.
sourcetype = messagequeue
index = automation
disabled=0
[monitor:///var/logs/]
recursive=true
whitelist =.err.
sourcetype = errlog
index = automation
disabled=0

not sure how we can use different sourcetypes for the same sub folders

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...