Getting Data In

inputs.conf batch wildcard not working

dbray_sd
Path Finder

Here is the inputs.conf entry:

 

[batch://opt/splunk/var/run/splunk/csv/*.csv]
disabled = false
move_policy = sinkhole
index = test-metrics
sourcetype = metrics_csv

 

 

However, as I monitor /opt/splunk/var/run/splunk/csv/ I see the CSV files are still there, and not getting indexed. This should have been a really simple test, but can't figure out why batch is not working.

If I hardcode a specific CSV file it works:

 

[batch://opt/splunk/var/run/splunk/csv/test.csv]
disabled = false
move_policy = sinkhole
index = test-metrics
sourcetype = metrics_csv

 

 

But obviously I need it to get all the CSV files, so I should be able to use the wildcard *.csv

Labels (1)
0 Karma
1 Solution

dbray_sd
Path Finder

Wow, what a simple typo that was really hard to see until I took the time and ran:

sudo -u splunk /opt/splunk/bin/splunk list inputstatus

/opt/splunk/var/run/splunk/csv/test.csv
parent = opt/splunk/var/run/splunk/csv/*.csv
type = File did not match whitelist '^opt\/splunk\/var\/run\/splunk\/csv/[^/]*\.csv$'. 

That little ^opt at the beginning showed me that I was missing an extra "/" in:

[batch://opt/splunk/var/run/splunk/csv/*.csv]

It should be:

[batch:///opt/splunk/var/run/splunk/csv/*.csv]

 

So, all good to go.

 

View solution in original post

0 Karma

dbray_sd
Path Finder

Wow, what a simple typo that was really hard to see until I took the time and ran:

sudo -u splunk /opt/splunk/bin/splunk list inputstatus

/opt/splunk/var/run/splunk/csv/test.csv
parent = opt/splunk/var/run/splunk/csv/*.csv
type = File did not match whitelist '^opt\/splunk\/var\/run\/splunk\/csv/[^/]*\.csv$'. 

That little ^opt at the beginning showed me that I was missing an extra "/" in:

[batch://opt/splunk/var/run/splunk/csv/*.csv]

It should be:

[batch:///opt/splunk/var/run/splunk/csv/*.csv]

 

So, all good to go.

 

0 Karma

aasabatini
Motivator

Hi @dbray_sd 

try this

[monitor///opt/splunk/var/run/splunk/csv/*.csv]

if doesn't work and on your path are present only csv you can try this

[monitor///opt/splunk/var/run/splunk/csv/]
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

dbray_sd
Path Finder

I need it to be batch, not monitor.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...