About daymar_23

Azeemering · ‎10-01-2021

Have you tried [monitor://D:\package\*\version\Admin\APIS\log] Example from the docs Specify input paths with wildcards - Splunk Documentation To monitor /apache/foo/logs, /apache/bar/logs, but not /apache/bar/1/logs or /apache/bar/2/logs, create the following stanza: [monitor:///apache/*/logs]

daymar_23 · ‎06-04-2021

Well, it doesn't work 😞 I will submit a case with the support team to know what else I can do. Thanks for your help @s2_splunk

saravanan90 · ‎02-05-2021

In inputs.conf we configure the file which needs to be monitored as below. We can add the "ignoreOlderThan = 2d" as below in inputs.conf so that it will exclude the files which are older than 2 days. [monitor://path_to_logfile.log] disabled = false index = iis sourcetype = iis crcSalt = <SOURCE> ignoreOlderThan = 2d If we need to go through each individual events and ignore the data then we can add them where it is being parsed. If we are using intermediate Heavy forwarder for parsing, then configure here. If the logs being collected are sent directly to indexers then we can configure the below in indexers. props.conf [iis] MAX_DAYS_AGO=2

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-02-2021

Online Status	Offline
Date Last Visited	‎09-27-2021 12:06 PM

Wildcard ... not working in my stanza

Splunk Update from 7.2.1 to 8.1.4 not working

Don't forward old IIS Logs to Splunk

Re: Wildcard ... not working in my stanza

Re: Splunk Update from 7.2.1 to 8.1.4 not working

Re: Don't forward old IIS Logs to Splunk

Are you a member of the Splunk Community?