Hi,
My issue is i need to monitor only 3 folders out of 9 folders is there any way that i can do this in the inputs.conf instead of adding all 3 folders and the files under them in separate monitor statements
ex:
Folder names are xxx1,xxx2,xxx3,......xxx9
i only need data from 1,2,3 folders , and multiple files under them
so in monitor statement in inputs.conf
/mnt/qa/xxx1/appslog/yyy/filename.log
instead of having statements for all 3 folders , can i do it one single monitor statement for all 3 folders if am monitoring files with same names under them ( by not including folders xxx4---xxx9
You could try something like the below. I think it might work. I have a blacklist version of that setup to skip certain folders under /var/log on some systems:
[monitor:///mnt/qa/]
whitelist = (xxx1|xxx2|xxx3)
Reference:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata
You could try something like the below. I think it might work. I have a blacklist version of that setup to skip certain folders under /var/log on some systems:
[monitor:///mnt/qa/]
whitelist = (xxx1|xxx2|xxx3)
Reference:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata
Thanks starcher that helped me