Getting Data In

Input paths with wildcards for the sub-directories tree

mlevsh
Builder

Hi,

I haven't dealt a lot with wildcards in Paths for Inputs, so will appreciate your help.

We need to monitor logs in SyslogLog sub-directory:

/opt/our-application/var/log/our-processor/message_logging/dev/<environment>/<proxy-name>/<revision>/SyslogLog/name_of_log.log

For example from the following available directories we need to get only 1),4), 5) and 7) ,8), 10)files

1) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log
2) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log.1
3) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/1/SyslogLog/name_of_1_log.log.2
4) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/2/SyslogLog/name_of_2_log.log
5) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/3/SyslogLog/name_of_3_log.log
6) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_1/3/FastLog/name_of_4_log.log

7) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/1/SyslogLog/name_of_5_log.log
8) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/2/SyslogLog/name_of_6_log.log
9) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/3/FastLog/name_of_7_log.log
10) /opt/our-application/var/log/our-processor/message_logging/dev/dev/company_proxy_name_2/4/SyslogLog/name_of_8_log.log

Will the following template on the Path with "*" work?

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype
0 Karma
1 Solution

woodcock
Esteemed Legend

Missed it by >that< much; try this:

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype

View solution in original post

woodcock
Esteemed Legend

Missed it by >that< much; try this:

[monitor:///opt/our-application/var/log/our-processor/message_logging/dev/*/*/*/SyslogLog/*.log]
index = our_index
sourcetype = our_sourcetype

woodcock
Esteemed Legend

This assumes that .../dev/dev/... is really the path and not a double-paste error.

0 Karma

mlevsh
Builder

@woodcock , sorry for a delay.
Tested and it worked. Thank you so much as always!

mlevsh
Builder

@woodcock , thank you! Will test tomorrow!
.../dev/dev/... is really the path.
it is possible that users might have other sub-folders under first dev.
Something like .../dev/dev_pse/...

Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...