Getting Data In

setting up wildcard data inputs on windows forwarder

marguin
New Member

I am configuring a windows server with splunk, which i will be changing to a forwarder once i get it finding the data correctly. based on the documentation for using wild cards i came up with this:

i need to collect logs files from : C:\MT4+EA-Farm\assigned\*\experts\logs and i want any file in that directory...so:

(from C:\Program Files\Splunk\etc\system\local\inputs.conf)

[monitor://C:\MT4+EA-Farm\assigned\...\experts\logs\*.*]
disabled = false
followTail = 0
host = ea2-20
sourcetype = eafarm

restart splunkd and i see these errors in the splunkd.log file.

06-08-2012 19:34:52.746 +0000 ERROR TailingProcessor - matching C:\MT4+EA-Farm\assigned\u43096_c13058\ against ^C:\\MT4+EA-Farm\\assigned\\.*\\experts\\logs\\[^\\]*\.[^\\]*$

what am i doing wrong here?

0 Karma

jnhth
Explorer

I got this answer from support:

"Can I confirm that you running Splunk 4.3.1 or 4.3.2?
If so I believe that you have run into a known bug SPL-49599 (Files not indexed because they don't match the whitelist of a higher-level overlapping stanza)
This issue is being worked on by the developemnt team and should be addressed in Splunk 4.3.3 which is due for release in the coming weeks."

Hope this helps you 🙂

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...