monitor file with dynamic directiory name

Question

I have the following folder listing in C:\Resources\Directory\ which the naming of the folder are dynamic. It changes dynamically when logs are created with this type of prefix (dynamic).(dynamic).(Fixed)

Example : (dynamic) . (dynamic) . (Fixed) 0068f67b289b43dfb5302cb26cb9e536.KeyValidationWebRole.DiagnosticStore 0068f67b289b43dfb5302cb26cb9e536.KeyValidationWebRole.localInstallDirectory 0068f67b289b43dfb5302cb26cb9e536.KeyValidationWebRole.LogStorage

Questions :

Let say I want to index all files under 0068f67b289b43dfb5302cb26cb9e536.KeyValidationWebRole.DiagnosticStore. Can I structure my inputs.conf monitor stanza using wildcards example for all new created dynamic foldername ? :

[monitor://C:\Resources\Directory\*.*.DiagnosticStore]
disabled = false
followTail = 0
sourcetype = mysourcetype

Let say in my inputs.conf I index entire folder under C:\Resources\Directory but there is several files under *.KeyValidationWebRole.DiagnosticStore which needs props.conf to change the encoding. How do I write the config stanza that need the encoding exception ?

Answer 1

0

On the first question, I would use the "..." syntax in your monitor stanza. For instance:

[monitor://C:ResourcesDirectory...DiagnosticStore]

On the second question you can use the "..." syntax as well in the prop.conf to pull out only certain files and give them specific encoding. For instance:

[source::...KeyValidationWebRole.DiagnosticStore...] sourcetype=awesome

Might help to see what the file names under this directory.

link

answered 02 Nov '11, 06:16

tgow
1.1k●4●3●17
accept rate: 17%

Tried your solution and it does not work

Not working

[monitor://C:\Resources\Directory\ ..DiagnosticStore]

[monitor://C:\Resources\Directory\...DiagnosticStore]

[monitor://C:\Resources\Directory\*DiagnosticStore]

Any suggestions ??

(02 Nov '11, 07:10) wickett

Answer 2

Looking at the online docs I see the following:

Note concerning wildcards and monitor:

You can use wildcards to specify your input path for monitored input. Use "..." for recursive directory matching and "*" for wildcard matching in a single directory segment.
"..." recurses through directories. This means that /foo/.../bar will match foo/bar, foo/1/bar, foo/1/2/bar, etc.
You can use multiple "..." specifications in a single input path. For example: /foo/.../bar/...
The asterisk () matches anything in a single path segment; unlike "...", it does not recurse. For example, /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc. However, it does not match /foo/1/2/bar . A second example: /foo/m*r/bar matches /foo/bar, /foo/mr/bar, /foo/mir/bar, /foo/moor/bar, etc.
You can combine "" and "..." as required: foo/.../bar/ matches any file in the bar directory within the specified path.

Are there files under the DiagnosticStore directory?

[monitor://C:ResourcesDirectory...DiagnosticStore...]

Does this work.

Here is the link to more info in the Docs:

http://docs.splunk.com/Documentation/Splunk/4.2.4/admin/Inputsconf

monitor file with dynamic directiory name

Follow this question

Splunk Resources

Related questions