I wanted to add a monitor for a file using an wildcard as part of the name as the file name will change daily. I added the following monitor:
file name = myfile.log-2011-11-04
splunk add monitor myfile.log-*
This resulted in a monitored log file for myfile.log-2011-11-04 which is fine for the current file but I want the next file myfile.log-2011-11-05 to be automatically monitored as well.
Will this be the case? I didn't see any examples in the documentation for adding a wildcard for a file, only directory paths.
You can use the following syntax in your inputs.conf:
[monitor::...myfile.log...]
Here is information from the manual:
Note concerning wildcards and monitor:
You can use the following syntax in your inputs.conf:
[monitor::...myfile.log...]
Here is information from the manual:
Note concerning wildcards and monitor: