I want to monitor a log file from the below location on a Windows server.
D:\Program Files\Apache Software Foundation\Tomcat 8.5\webapps\config\
However, based on the version of tomcat, the folder name changes. It could be Tomcat 6.0 or Tomcat 7.5 — etc. — on some servers. So, I tried with a different input stanza on the Universal Forwarder in the inputs.conf file.
[monitor://d:\Program Files\Apache Software Foundation\Tomcat*\webapps\config\audit.log]
[monitor://d:\Program Files\Apache Software Foundation\\*\webapps\config\audit.log]
[monitor://d:\Program Files\Apache Software Foundation\\...\webapps\config\audit.log]
None of the above options work and in the Splunkd.log file, I can see the below entry
09-28-2018 13:44:24.422 +0000 INFO TailingProcessor - Adding watch on path: d:\Program Files\Apache Software Foundation.
which means it is not recognizing folder structure mentioned in input stanza.
Please suggest a solution.
↧