I observed that none of the log files are not indexed into Splunk when I used the environment variable, in my case it's the Windows OS "$PROGRAMFILES" env variable. An example is as below:
and there are two files in logs folder "startServer.log" and "stopServer.log".
However I noticed a different behavior when I used
Both "startServer.log" and "stopServer.log" are indexed into Splunk.
Is this a known limitation to only use the absolute path in the inputs.conf to monitor log files?
asked 16 May '10, 05:09
Nicholas Key ♦♦
No. In fact, Splunk itself uses the
answered 16 May '10, 06:51
There is an example of this being used in the windows app. Looking at Win 2k8 environment variables I see a system variable of "windir". This leads me to believe it must be a system variable (or perhaps a user variable matching the user running the splunkd service), and is case insensitive.
answered 11 Apr '11, 18:57