Getting Data In

splunk uf not reading logs

AzmathShaik
Path Finder

hellowe’ve directory structure as follows
/apps/ftp/user/logs/admin -- main directory
sub-directories
2018 2019 2020
and further more each sub-directory with year has directories with months as
01 02 02 03 04 05 06 07 08 09 10
under months directories we have csv log filesso to access a csv file for today
/apps/ftp/user/logs/admin/2020/10/20201008.csvhere is monitor stanza for to read this file
[monitor:///apps/*/user/logs/admin/.../.../*.csv]
disabled = false
sourcetype = csv
index= user-access-logs
crcSalt = <SOURCE>but it’s not reading logs and no error in splunkd logs. can someone help me in correcting the monitor stanza if i’ve done mistake

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you try to replace .../... with ... as ... means any number of subdirectories. Other option is replace it with */*
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...