Getting Data In

Some logs have timestamps in filename, some don't, combine into 1

derekslenk
New Member

Hello,

We are having problems with logging a certain file pattern, which is coming from Sitecore (shouldn't matter).

The first time in the day that the service is restarted/recycled, it creates a file like: log.20170502.txt

However, on subsequent restarts, it creates log files with timestamps, like: log.20170502.085920.txt

Is there any way to set up the forwarder to make it look like to the search heads/indexers that it all comes from log.txt?

Thanks in advanced.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

If each of those log files carries distinct data, then just set up your regex to catch all of them, with something like this...

log\.(\d+\.){0,2}txt

or

log\.\d+\.\d+?\.?txt
0 Karma

derekslenk
New Member

But what we are trying to do is have it show up as just log.txt in the search head, just for easing searching among files.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...