[monitor:///tmp/ABC.txt] is my monitor stanza.
But if i have the file welcomeabcdef.txt that is "abc" (lowercase instead of uppercase) will it be read and indexed by Splunk?
Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.
Bye.
Giuseppe
Hey Madhan45, if they
solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!
Hi Madhan45,
path after monitor:// is a unix path that is case sensitive!
This problem isn't present on Windows.
I usually test on shell every monitor stanza to be sure that result is the one I want.
Bye.
Giuseppe
Thanks for response Giuseppe.
so you meant to say "(astric)ABC(actric).txt", will not capture "welcomeabcde.txt" file in unix?
Is my understanding is correct?
yes,
you can test it in linux with the command
ls -al /your_path/*ABC*.txt
Anyway, you have to create two stanzas in inputs.conf.
Bye.
Giuseppe
Ok thanks.
if, this solution satisfies your question,please accept or upvote it.
Bye.
giuseppe
Setting:
[monitor:///tmp/ABC.txt]
File name :
welcomeabcdef.txt