Refine your search:

Hello all,

my direcotry structur :

/data/A/logs/aaaaaaa.log
/data/A/logs/aaaaaaa1.log
/data/B/logs/aaaaaaa.log
/data/B/logs/aaaaaaa1.log

my inputs.conf

[monitor:///data/*/logs]
sourcetype=mysourcetype
index=idx_myindex_dev
disabled=false

A) If I'am putting the Fullpath "for example /data/A/logs/" to the monitor field it works fine
B) If I try it with the inputs.conf above, he lists me only the directorys, but doesn't index any file. In the Splunkd.log he says Parsing configuration stanza: monitor:///data/*/logs. No error, no information.

According to the Documentation :
`The asterisk () matches anything in a single path segment; unlike "...", it does not recurse. For example, /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc. However, it does not match /foo/1/2/bar.

wich is fine for me, anyway I tried it also with the [...] ( /data/.../logs) witch would be also fine for me but that doesn't work either.

Q : Any Idea what I'am doing wrong ?

Universalforwarder : 4.2.3
OS : AIX 6.1
Documentation : http://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf

asked 24 Aug '11, 05:05

Christian's gravatar image

Christian
73118
accept rate: 22%


One Answer:

I think you'll find a very detailed explanation here ... Regex's and Windows paths in inputs.conf and props.conf on Splunk Answers

link

answered 24 Aug '11, 10:29

rroberts's gravatar image

rroberts
1.7k218
accept rate: 44%

thx the refrence articel answers my qustion

(10 Nov '11, 05:47) Christian
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×150
×45

Asked: 24 Aug '11, 05:05

Seen: 594 times

Last updated: 10 Nov '11, 05:47

Copyright © 2005-2012 Splunk Inc. All rights reserved.