Sorry if this is answered somewhere in the documentation (I couldn't find it after a fairly cursory glance).
We have various unix daemon processes that all have current dir’s under a specific node in the directory structure. They all share a similar naming convention. I was wondering if it is possible to configure a forwarder to ‘discover’ new log files for any new processes we add?
If this is possible, does it require that the forwarder be bounced?
I suppose this would be possible via the CLI as we deploy the new process as part of it's deployment script.
Thanks Hugh
Hi ahughf
yes, sure you can do this. Take a look at http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Specifyinputpathswithwildcards for some monitor examples using wildcards. Further you can use white- and/or blacklist to have only *.log
indexed.
And another yes, you can use CLI to add monitors find examples here
hope this helps
cheers,
MuS
dammit, you were 14 seconds faster 🙂