splunk list monitor directories or files

[lqiao]

Hi,

When I execute command splunk list monitor: I see that there are two different types of monitoring: Monitored directories and Monitored Files.

For one specific monitored directory, does all the files of all the subfolders be monitored?
Thank you.

[bmacias84 · Accepted solution]

@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.

Example:

#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored.  So splunk list monitor would not list them if they where not already indexed.

[monitor:\$SPLUNK_HOME\var\log\splunk]

ignoreOlderThan=2d

blacklist=metric