In inputs. conf, which stanza would mean Splunk was only reading one local file?

Question

Options

• A[read://opt/log/crashlog/Jan27crash.txt]
• B[monitor::/ opt/log/crashlog/Jan27crash.txt]
• C[monitor:/// opt/log/]
• D[monitor:/// opt/log/ crashlog/Jan27crash.txt]

• A
  3% (1)
• B
  89% (34)
• C
  5% (2)
• D
  3% (1)

Explanation

A [monitor://] stanza pointing to a specific file path causes Splunk to monitor only that single file. Option B specifies the exact file Jan27crash.txt, so only one file is read. Option A uses the scheme 'read://' which is not a valid inputs.conf stanza type in Splunk. Option C uses [monitor:///opt/log/] which points to a directory, causing Splunk to monitor all files within that directory recursively-not a single file. Option D uses [monitor:///opt/log/ crashlog/Jan27crash.txt] which contains a space in the path, making it syntactically invalid and non-functional as written.

No community discussion yet for this question.