Getting Data In

monitor stanza - help

rakesh_498115
Motivator

Hi.

I have a common log path in my server say logs/project1/ which has perflogs and debuglogs i.e like this Appt_Perflog_ms1,Appt_Perflog_ms2 .. ,ABC_Perflog_ms1,ABC_Debug_ms1.txt .. Now i need these logs i.e perflogs to move to perf index and debug to debug index. so for that i have used the following monitor stanza.

[monitor:///logs/project1/*_Debug_ms*.txt]
blacklist = \.(gz)$
whitelist = ABC_Debug_ms[1-4]{1}.txt$ 
disabled = false
followTail = 0
recursive = false
sourcetype = debug_log
index = debuglogs



[monitor:///logs/project1/*_Perflog_ms*.txt]
blacklist = \.(gz)$
whitelist = (Appt_Perflog_ms[1-4]{1}.txt$ | ABC_Perflog_ms[1-4]{1}.txt$ )
disabled = false
followTail = 0
recursive = false
sourcetype = perf_log
index = perflogs

but this seems to be not working ?? any clue what happened here ?? is the **_* in monitor stanza causing this issue..pls help me..

Tags (2)
0 Karma

lukejadamec
Super Champion

You don't need the '_'. Have you tried this?

[monitor:///logs/project1/*Debug*.txt]

[monitor:///logs/project1/*Perflog*.txt]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...