I configured my forwarder as :
[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]
disabled = false
followTail = 0
host = sumosamprd76
index = prd
sourcetype = sumologs
But why is it I cannot search the logs under "logger/simlog.log" logfile when I ran the below query? Is there something wrong in configuring forwarder with wild card (i.e asterisk)?
source=/sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/logger/simlog.log
Please help. thanks
monitor is specified.
[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]
↓
[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/*.log]
(EX.)
To monitor any file directly under /apache/ that ends in .log:
[monitor:///apache/*.log]
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards
Be considered as a reason you can not search
1. Has not been taken up log
2. INDEX of interest is not the default search
→ Please add "index = prd" in the search condition.
3. Is wrong specified SOURCE
monitor is specified.
[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs//.log]
↓
[monitor:///sumoprd/app/oracle/prod/xeware/usr_projects/domains/bifoundation_domain/servers/bi_server1/logs/*.log]
(EX.)
To monitor any file directly under /apache/ that ends in .log:
[monitor:///apache/*.log]
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Specifyinputpathswithwildcards
Be considered as a reason you can not search
1. Has not been taken up log
2. INDEX of interest is not the default search
→ Please add "index = prd" in the search condition.
3. Is wrong specified SOURCE
cheers! thanks