I am attempting to read different types of log into various sources. But all the logs belong in the same directory and i cannot have multiple monitors in them
the various logs are located at desktop\test\
My initial attempt involved only using websplunk but i realised we cannot have more than one monitor on the same directory.
i tried with inputs.conf
[monitor://C:\Documents and Settings\attgjh1\Desktop\test\pulsar*]
disabled = false
followTail = 0
sourcetype = pulsar
the same settings were also created for the other logs.
however, splunk did not index any of the logs at all. (even after restarting)
im fairly new to using props.conf and inputs.conf to do stuffs.
can someone help me? thanks!
The monitor stanzas will be in inputs.conf and you can edit the file directly rather than use the UI but that should work as well. You could just use the following and splunk will monitor all files in that directory.
[monitor://C:Documents and Settings\attgjh1\Desktop\test]
You can also use wildcards
http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards
If there are files you don't want you can use a blacklist like this.
/#i want to ignore zipped files
blacklist = .(gz|bz2|z|zip)$
The monitor stanzas will be in inputs.conf and you can edit the file directly rather than use the UI but that should work as well. You could just use the following and splunk will monitor all files in that directory.
[monitor://C:Documents and Settings\attgjh1\Desktop\test]
You can also use wildcards
http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards
If there are files you don't want you can use a blacklist like this.
/#i want to ignore zipped files
blacklist = .(gz|bz2|z|zip)$