splunk.es.data_input_monitor module – Manage Splunk Data Inputs of type Monitor
Note
This module is part of the splunk.es collection (version 4.0.0).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install splunk.es
.
To use it in a playbook, specify: splunk.es.data_input_monitor
.
New in splunk.es 1.0.0
DEPRECATED
- Removed in:
major release after 2024-09-01
- Why:
Newer and updated modules released with more functionality.
- Alternative:
splunk_data_inputs_monitor
Synopsis
This module allows for addition or deletion of File and Directory Monitor Data Inputs in Splunk.
Aliases: splunk_data_input_monitor
Parameters
Parameter |
Comments |
---|---|
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed. |
|
If set to Choices:
|
|
If set to Choices:
|
|
A string that modifies the file tracking identity for files in this input. The magic value <SOURCE> invokes special behavior (see admin documentation). |
|
Indicates if input monitoring is disabled. Choices:
|
|
If set to Choices:
|
|
The value to populate in the host field for events from this data input. |
|
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group. |
|
Use the specified slash-separate segment of the filepath as the host field value. |
|
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored. |
|
Which index events from this input should be stored in. Defaults to default. |
|
The file or directory path to monitor on the system. |
|
Setting this to false prevents monitoring of any subdirectories encountered within this data input. Choices:
|
|
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs. |
|
The value to populate in the sourcetype field for incoming events. |
|
Add or remove a data source. Choices:
|
|
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data. |
|
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed. |
Examples
- name: Example adding data input monitor with splunk.es.data_input_monitor
splunk.es.data_input_monitor:
name: "/var/log/example.log"
state: "present"
recursive: true
Status
This module will be removed in a major release after 2024-09-01. [deprecated]
For more information see DEPRECATED.