Monitor input
Matt Lauber edited this page Oct 31, 2013
·
1 revision
This resource defines the [monitor://]
stanza(s) used in the inputs.conf file. It has one required attribute path
. The supported attributes are based on the inputs.conf.spec. An example of a [monitor://<path>]
stanza definition is as follows:
splunk::input::monitor { 'title':
path => ['/path/to/log/file', '/path/to/log/file']
host => 'host',
index => 'index',
source => 'source',
sourcetype => 'sourcetype',
queue => 'queue',
host_regex => 'regex',
host_segment => 1,
whitelist => 'regex',
blacklist => 'regex',
crcSalt => 'crcSalt',
initCrcLength => 256,
ignoreOlderThan => '1d',
followTail => 0,
alwaysOpenFile => 0,
time_before_close => 256,
recursive => 'true',
followSymlink => 'true'
}