Getting Data In

inputs.conf behaviour doesn't corespond with documentation

Christian
Path Finder

Hello all,

my direcotry structur :

/data/A/logs/aaaaaaa.log
/data/A/logs/aaaaaaa1.log
/data/B/logs/aaaaaaa.log
/data/B/logs/aaaaaaa1.log

my inputs.conf

[monitor:///data/*/logs]
sourcetype=mysourcetype
index=idx_myindex_dev
disabled=false

A) If I'am putting the Fullpath "for example /data/A/logs/" to the monitor field it works fine

B) If I try it with the inputs.conf above, he lists me only the directorys, but doesn't index any file. In the Splunkd.log he says Parsing configuration stanza: monitor:///data/*/logs. No error, no information.

According to the Documentation :
`The asterisk () matches anything in a single path segment;
unlike "...", it does not recurse. For example,
/foo/
/bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar,
etc. However, it does not match /foo/1/2/bar.

wich is fine for me, anyway I tried it also with the ... witch would be also fine for me but that doesn't work either.

Q : Any Idea what I'am doing wrong ?

Universalforwarder : 4.2.3

OS : AIX 6.1

Documentation : http://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf

Tags (2)
0 Karma
1 Solution

rroberts
Splunk Employee
Splunk Employee

rroberts
Splunk Employee
Splunk Employee

Christian
Path Finder

thx the refrence articel answers my qustion

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...