Getting Data In

How to monitor logs 7 directories deep?

ned692000
Engager

Hi, I’m trying to monitor changing log files within directories that change regularly. These log files are 7 layers deep on a Netapp share. I’m setting up the monitor stanza in inputs.conf on a Linux box. I have tried everything but only certain directories at the 3rd layer are being monitored, but not others at that same layer, including the one I need. I’ve added recursive = true and tried all variations of syntax with no luck. All permissions are the same as directories that can be monitored. What am I doing wrong?

Thanks in advance.

Labels (2)
Tags (1)
0 Karma

livehybrid
Builder

What does your inputs.conf stanza for the input currently look like? 

You should be able to use ellipsis (...) to look recursively:

For example:

 "..." searches recursively through one or more directories. This means that
  /foo/.../bar matches foo/1/bar, foo/1/2/bar, etc.

Whereas * does not look recursively.

https://docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Inputsconf#:~:text=%22...%22%20searches%20r....

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...