Splunk Search

wildcard monitoring

a212830
Champion

Hi,

I'm doing some testing in my lab, and want to monitor all files in a directory that don't have .csv. I have the following in my inputs.conf

[monitor:///usr/local/nsmutils/export/current/]
index=perfstats
sourcetype=snmpinfo
followTail = 0
blacklist = .csv

However, nothing is getting indexed. Files are there and readable. I did a "oneshot" and the data looks good, but now I want to add it properly. Am I missing something? Somewhat related... I am also using this as an indexer. Do I need an outputs.conf in this situation, since the data is being indexed here? Could that be the problem?

Tags (1)
0 Karma

Dimitri_McKay
Splunk Employee
Splunk Employee

So you are looking at a folder and in it you have mixed software types. Is there a reason you aren't just naming out the types you have instead? Or are you just testing the blacklist functionality?

0 Karma

a212830
Champion

It's easier to do the blacklist - too many files to do a whitelist.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...