I want to monitor the following paths. I tried these two stanzas and neither of them work.
In the documentation - "The asterisk () matches anything in a single path segment;" Any suggestion why **batch** does not work?
Expected directories to monitor:
/opt/apps/aaa/bbb/ccc/batch/logs
/opt/apps/aaa/bbb/ccc/batch2/logs
Directory structure:
/opt/apps/aaa/bbb/ccc/batch/logs
/opt/apps/aaa/bbb/ccc/junk/logs
/opt/apps/aaa/bbb/ccc/batch2/logs
Does not work
[monitor:///opt/apps/aaa/bbb/ccc/batch*/logs]
[monitor:///opt/apps/aaa/bbb/ccc/batch(\d?)+/logs]
./splunk list monitor
Monitored Directories:
[No directories monitored.]
Monitored Files:
[/var/log]
Because of files extention specification
Here is what you was suppose to do for example, to monitor .log files:
[monitor:///opt/apps/aaa/bbb/ccc/batch*/logs]
whitelist=\.log$
or
[monitor:///opt/apps/aaa/bbb/ccc/batch*/logs/*.log]
Because of files extention specification
Here is what you was suppose to do for example, to monitor .log files:
[monitor:///opt/apps/aaa/bbb/ccc/batch*/logs]
whitelist=\.log$
or
[monitor:///opt/apps/aaa/bbb/ccc/batch*/logs/*.log]
I am able to get it working with
[monitor:///opt/apps/aaa/bbb/ccc/batch*/logs/*]
Anyone know why?
Exactly same happened for me, it was not monitoring the log files with wildcard in the path
[monitor://D:\applications\jee\*\logs]
whitelist = \.log.*$|\.txt.*$|\.traceout.*$
crcSalt = <SOURCE>
disabled = false
followTail = false
ignoreOlderThan = 7d
index = websphere
08-17-2016 14:42:00.982 +1000 INFO TailingProcessor - Parsing configuration stanza: monitor://D:\applications\jee*\logs.
08-17-2016 14:42:00.982 +1000 INFO TailingProcessor - Adding watch on path: D:\applications\jee.
But it started working when I added * at the end 🙂
[monitor://D:\applications\jee\*\logs\*]
whitelist = \.log.*$|\.txt.*$|\.traceout.*$
crcSalt = <SOURCE>
disabled = false
followTail = false
ignoreOlderThan = 7d
index = websphere
Just figured out it is not about having * at the end of directory path , it needs \ at the end of directory path. So following also works
[monitor://D:\applications\jee\*\logs\]
whitelist = \.log.*$|\.txt.*$|\.traceout.*$
crcSalt = <SOURCE>
disabled = false
followTail = false
ignoreOlderThan = 7d
index = websphere