Getting Data In

Can you help me with wildcard usage in the inputs.conf monitoring path?

damucka
Builder

Hello,

I have the following paths to monitor:

[monitor:///usr/sap/ICP/D15/work/dev_*]
[monitor:///usr/sap/ICP/ASCS14/work/dev_*]

For the several logfile patterns, like dev_*, vmc*, etc.

My idea is to create a separate monitoring entries for each logfile pattern together with the whitelist of it.

However, in order to avoid doubling for the D15 and ASCS15, is it possible to use the wildcards in the monitored path for that?

Like for the example below to use * in the path having sth. as below:

[monitor:///usr/sap/ICP/*/work/dev_*]

Kind Regards,
Kamil

0 Karma
1 Solution

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

0 Karma

FrankVl
Ultra Champion

Both * and ... should work in this case. ... also works if there are more levels of subdirectories, * doesn't match / so only works for 1 level.

0 Karma

damucka
Builder

Would tha be:
[monitor:///usr/sap/ICP/.../dev_*]

?

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...