Getting Data In

How to use wildcards on inputs.conf to monitor specific directories?

a212830
Champion

Hi,

I need to monitor the following:

/apps/log//access/today

today is the file, but the webserver name directory could be almost anything. Some begin with www, some begin with https, some have dashes, some have .com....

What can I enter so that I monitor any dir that has -8443 (and then the subdirs listed).

1 Solution

strive
Influencer

I did a quick test and this works. Try it

/apps/log/*-8443*/access/today

The directories that i created are like this

/apps/log/abc-8443=123/access/today  
/apps/log/abc.123.-8443=123/access/today  
/apps/log/123_abc_def.efg-8443=456/access/today
/apps/log/abc-8000=123/access/today

alt text

View solution in original post

strive
Influencer

I did a quick test and this works. Try it

/apps/log/*-8443*/access/today

The directories that i created are like this

/apps/log/abc-8443=123/access/today  
/apps/log/abc.123.-8443=123/access/today  
/apps/log/123_abc_def.efg-8443=456/access/today
/apps/log/abc-8000=123/access/today

alt text

a212830
Champion

I'm weak on regex. My concern is that something with multiple dots or dashes won't get picked up.

0 Karma

strive
Influencer

did you try something like this
/apps/log/-8443/access/today

wildcards are not displayed in comment

/apps/log/star-8443star/access/today

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...