I want to write a monitor stanza that picks up a log named "mytest.log" which may be found in either /var/log/app/ or /var/log/app/testlogs/
according to this: http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Specifyinputpathswithwildcards, it seems possible to do what i want by defining [monitor:///var/log/app/*/mytest.log
specifically described in this section of the table describing use of "": /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc.
My monitor stanza is:
[monitor:///var/log/app/*/mytest.log]
index = lab
sourcetype = log4j
blacklist = .(gz|bz2|z|zip)$
i expected splunk to pick up both /var/log/app/mytest.log and /var/log/app/testlogs/mytest.log, but instead only the latter is actually picked up. it seems that the base dir of /var/log/app/ is not being searched
The important part in the documentation topic you are referencing is this one :
Wildcard : *
Description : The asterisk wildcard matches anything in that specific directory path segment. Unlike "...", "*" doesn't recurse through any subdirectories.
Regex equivalent : [^/]*
This means that your stanza definition of [monitor:///var/log/app/*/mytest.log]
translates into the following regular expression :
/var/log/app/[^/]*/mytest.log
This will not match the following path :
/var/log/app/mytest.log
What you need is for your stanza definition to be [monitor:///var/log/app/...mytest.log]
.
The important part in the documentation topic you are referencing is this one :
Wildcard : *
Description : The asterisk wildcard matches anything in that specific directory path segment. Unlike "...", "*" doesn't recurse through any subdirectories.
Regex equivalent : [^/]*
This means that your stanza definition of [monitor:///var/log/app/*/mytest.log]
translates into the following regular expression :
/var/log/app/[^/]*/mytest.log
This will not match the following path :
/var/log/app/mytest.log
What you need is for your stanza definition to be [monitor:///var/log/app/...mytest.log]
.
"The asterisk () matches anything in a single path segment; unlike "...", it does not recurse.
For example, /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc.
However, it does not match /foo/1/2/bar . "
it's the piece that says "/foo//bar matches the files /foo/bar " that i think is wrong. it's what led me to believe that /var/log/app//mytest.log would match /var/log/app/mytest.log
How so? Please quote the page/block of text that makes you say so, I'd be happy to fix it.
i'll try this out. it makes sense, but it means the documentation inside inputs.conf is wrong