2

The current log file name I have is: catalina.2010-02-24.log.

I want to add this for splunk indexing, but i am running into problems, since there is no static file name, since everyday tomcat renames the log file.

[tail:///var/logs/catalina.2010-02-24.log] is not gonna work. Is there a way around this problem

RainDoctor
  • 4,422
  • 3
  • 23
  • 25

2 Answers2

2

You can index either the whole directory, or use wildcards to select the appropriate files.

In your case, [monitor://var/logs/catalina.*.log] should work correctly.

dart
  • 61
  • 2
0

You could add a script that runs as a daily cron job which symlinks the file based on the date to catalina.current.log or something such as this.

Example:

ln -sf /var/logs/catalina.`date +%Y-%m-%d`.log /var/logs/catalina.current.log

Then of course just use catalina.current.log to access the current day's log.

Michael Mior
  • 388
  • 1
  • 5
  • 17