Hi,
I want to monitor the files in E:\data\pnlog as well as all the files in the subfolders. Is there any way to simplify this or a way to get this done in one stanza?
[monitor://E:\Data\pnlog\...\*]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup
[monitor://E:\Data\pnlog\*]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup
// Andreas
If you define a monitor on a folder, it is recursive by default. So if you specify
[monitor://E:\Data\pnlog]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup
It will montor all files recursivly that match the whitelist expression.
If you define a monitor on a folder, it is recursive by default. So if you specify
[monitor://E:\Data\pnlog]
whitelist = \.log$
disabled = false
followTail = 0
_TCP_ROUTING = pnlogGroup
It will montor all files recursivly that match the whitelist expression.
Yes. Quote "If the specified directory contains subdirectories, Splunk recursively examines them for new files." in http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories
Thank you! Is this to be found in the documentation?