Getting Data In

Splunk Forwarder Configuration?

nilaksh92
Path Finder

Hi Everyone,

Need some help on configuration of Splunk forwarder.

I have multiple log files under a directory. So, I have pointed the directory to fetch all logs from all file.

Is that correct way?

Now I have one requirement,

Under that directory "Nikks", I have log file named like

Log Files:-

abc.log
abc.log.1
abc.log.2
xyz.log
xyz.log.1
xyz.log.2

Like this I have lot of sets of log files under same directory.

I just want to sent logs from abc.log and xyz.log to splunk.

I don't need events from abc.log.1, abc.log.2 etc.

Please let me know how to configure the forwarder for this scenario.

Thanks in Advance
Nikks

Tags (2)
0 Karma

gjanders
SplunkTrust
SplunkTrust

The inputs documentation has many configuration options you could use, in your case you could:

  • Create a monitor:/// stanza for each file you want
  • Use the whitelist stanza with your existing directory reference: whitelist=\.log$
  • Use the blacklist stanza and exclude files you do not want.

I would use the whitelist option in your scenario if you are happy with either not hardcoding the sourcetype in the inputs.conf or having a single sourcetype for all the files.

Any of the options listed could work.

0 Karma

nilaksh92
Path Finder

Hi

Which one of below will work

whitelist=.log$ or whitelist=*.log

one more thing

I have some log file with timestamp as well.

like pqr.log.10/12/2017

I want to includes these files as well.

What I need is

abc.log
xyz.log
pqr.log.10/11/2017

what i don't want
abc.log.1
xyz.log.1

Please can you provide configuration for this scenario.

Thanks
Nikks

0 Karma

gjanders
SplunkTrust
SplunkTrust

I would suggest a website like http://regex101.com could be used for testing any regular expression.

So you could do:
whitelist = \.log(\.\d+/\d+/\d+)?$

Or you could make a blacklist for \.[123456789]$

The $ matches end of line however *.log would likely work

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...