The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Previous Topic: Parsing XML Files | Next Topic: Dropping Events or Eventtypes
Posts 1–2 of 2
I have a /dir that has both *gz files and *txt in it. I only want to add the couple hundred *.txt files. Splunk documents state I should be able to tail "add data input" using /dir/loc/*.txt and it will index all *.txt files found. Unfortunately it errors out and says dir can not be found. If I state ony tail /dir it works fine but then I will be burdened with all old data found in the *.txt AND *.gz files.
regards.
Paul,
Let's use a whitelist for this task:
http://www.splunk.com/doc/3.2.3/admin/adminfilewhiteblacklist
[tail:/dir/loc]
_whitelist = .*\.txt
Alternatively, a blacklist could work:
[tail:/dir/loc]
_blacklist = .*\.gz
-Alex
[Revised on Mon, 14 Apr 2008 10:56:49 -0700]
Sorry, the wiki formatting seems to have screwed up the tail stanza's, but you get the idea.