Home / server / Questions / 116459
Accepted
RainDoctor
Asked: 2010-02-25 14:16:40 +0800 CST

format of the log file format for splunk

  • 772

The current log file name I have is: catalina.2010-02-24.log.

I want to add this for splunk indexing, but i am running into problems, since there is no static file name, since everyday tomcat renames the log file.

[tail:///var/logs/catalina.2010-02-24.log] is not gonna work. Is there a way around this problem

splunk

2 Answers

  1. Best Answer

    You can index either the whole directory, or use wildcards to select the appropriate files.

    In your case, [monitor://var/logs/catalina.*.log] should work correctly.

    • 2

  2. You could add a script that runs as a daily cron job which symlinks the file based on the date to catalina.current.log or something such as this.

    Example:

    ln -sf /var/logs/catalina.`date +%Y-%m-%d`.log /var/logs/catalina.current.log

    Then of course just use catalina.current.log to access the current day's log.

    • 0