# https://github.com/example42/puppet-splunk/blob/master/manifests/input/monitor.pp
splunk::input::monitor { "messages":
path => "/var/log/messages",
index => "main",
sourcetype => "messages",
ignoreOlderThan => "2d",
blacklist => "\.(txt|gz|bz2)",
}
I had to hunt through the github repo for this module to figure out the above code. You add this as a separate class from the main install class. Hopefully this quick post will help someone in the future!
The path parameter is passed to a .each template so should be a list
ReplyDelete# https://github.com/example42/puppet-splunk/blob/master/manifests/input/monitor.pp
splunk::input::monitor { "messages":
path => [ "/var/log/messages" ],
index => "main",
sourcetype => "messages",
ignoreOlderThan => "2d",
blacklist => "\.(txt|gz|bz2)",
}