Getting Data In

splunk list monitor directories or files

lqiao
Explorer

Hi,

When I execute command splunk list monitor: I see that there are two different types of monitoring: Monitored directories and Monitored Files.

For one specific monitored directory, does all the files of all the subfolders be monitored?
Thank you.

Tags (3)
1 Solution

bmacias84
Champion

@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.

Example:


#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored. So splunk list monitor would not list them if they where not already indexed.
[monitor:\$SPLUNK_HOME\var\log\splunk]
ignoreOlderThan=2d
blacklist=metric

View solution in original post

0 Karma

bmacias84
Champion

@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.

Example:


#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored. So splunk list monitor would not list them if they where not already indexed.
[monitor:\$SPLUNK_HOME\var\log\splunk]
ignoreOlderThan=2d
blacklist=metric

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...