Getting Data In

Monitor files in a Windows Directory with wildcards

jeffbat
Path Finder

I am having a problem trying to monitor some files on some Windows servers.

The directories that I am trying to pick up the files from are:
D:\webroot\www.foo1.foo.cd\App_Data\logs
D:\webroot\www.foo1.foo.cm\App_Data\logs

And the file name will be similar to this:
Aggregation.log.20191103.224856.txt

I am needing to use wildcards in the path because the portion which is www.foo1.foo. changes based on which environment we are looking at and want to ensure as they bring up different environments the files are just automatically consumed.

I tried using an * in the path and it did not work. this is the inputs section right now (which is still not working):

Blockquote

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cm
whitelist = .+cm\App_Data\logs\Aggregation.+.txt$

[monitor://D:\webroot]
disabled = false
sourcetype = SiteCore:cd
whitelist = .+cd\App_Data\logs\Aggregation.+.txt$

Blockquote

any idea what I have wrong ?

woodcock
Esteemed Legend

Try this:

[monitor://D:\webroot\*.cm\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cm

[monitor://D:\webroot\*.cd\App_Data\Aggregation.*.txt]
disabled = false
sourcetype = SiteCore:cd
0 Karma

jeffbat
Path Finder

I tried that one (I actually thing that is the exact one that I originally used) but adding in the \logs part before Aggregation as you were slightly off with the directory name.

No luck on the files getting picked up.

Is there an issue with the fact that there is a wildcard in the path as well as a wildcard in the filename?

These seem to be the only files I am not able to get picked up.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jeffbat,
did you tried to check the path you used in monitor stanza using the dir command?

dir D:\webroot\*.cm\App_Data\logs\Aggregation.*.txt

do you have the file to monitor list?

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...