Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Splunk Provider
  3. API Docs
  4. InputsMonitor
Splunk v1.2.17 published on Wednesday, Apr 9, 2025 by Pulumi
pulumi/pulumi-splunk

splunk.InputsMonitor

Explore with Pulumi AI

Splunk v1.2.17 published on Wednesday, Apr 9, 2025 by Pulumi
pulumi/pulumi-splunk

# Resource: splunk.InputsMonitor

Create or update a new file or directory monitor input.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as splunk from "@pulumi/splunk";

const monitor = new splunk.InputsMonitor("monitor", {
    name: "opt/splunk/var/log/splunk/health.log",
    recursive: true,
    sourcetype: "text",
});
Copy
import pulumi
import pulumi_splunk as splunk

monitor = splunk.InputsMonitor("monitor",
    name="opt/splunk/var/log/splunk/health.log",
    recursive=True,
    sourcetype="text")
Copy
package main

import (
	"github.com/pulumi/pulumi-splunk/sdk/go/splunk"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := splunk.NewInputsMonitor(ctx, "monitor", &splunk.InputsMonitorArgs{
			Name:       pulumi.String("opt/splunk/var/log/splunk/health.log"),
			Recursive:  pulumi.Bool(true),
			Sourcetype: pulumi.String("text"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Splunk = Pulumi.Splunk;

return await Deployment.RunAsync(() => 
{
    var monitor = new Splunk.InputsMonitor("monitor", new()
    {
        Name = "opt/splunk/var/log/splunk/health.log",
        Recursive = true,
        Sourcetype = "text",
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.splunk.InputsMonitor;
import com.pulumi.splunk.InputsMonitorArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var monitor = new InputsMonitor("monitor", InputsMonitorArgs.builder()
            .name("opt/splunk/var/log/splunk/health.log")
            .recursive(true)
            .sourcetype("text")
            .build());

    }
}
Copy
resources:
  monitor:
    type: splunk:InputsMonitor
    properties:
      name: opt/splunk/var/log/splunk/health.log
      recursive: true
      sourcetype: text
Copy

Create InputsMonitor Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new InputsMonitor(name: string, args?: InputsMonitorArgs, opts?: CustomResourceOptions);
@overload
def InputsMonitor(resource_name: str,
                  args: Optional[InputsMonitorArgs] = None,
                  opts: Optional[ResourceOptions] = None)

@overload
def InputsMonitor(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  acl: Optional[InputsMonitorAclArgs] = None,
                  blacklist: Optional[str] = None,
                  crc_salt: Optional[str] = None,
                  disabled: Optional[bool] = None,
                  follow_tail: Optional[bool] = None,
                  host: Optional[str] = None,
                  host_regex: Optional[str] = None,
                  host_segment: Optional[int] = None,
                  ignore_older_than: Optional[str] = None,
                  index: Optional[str] = None,
                  name: Optional[str] = None,
                  recursive: Optional[bool] = None,
                  rename_source: Optional[str] = None,
                  sourcetype: Optional[str] = None,
                  time_before_close: Optional[int] = None,
                  whitelist: Optional[str] = None)
func NewInputsMonitor(ctx *Context, name string, args *InputsMonitorArgs, opts ...ResourceOption) (*InputsMonitor, error)
public InputsMonitor(string name, InputsMonitorArgs? args = null, CustomResourceOptions? opts = null)
public InputsMonitor(String name, InputsMonitorArgs args)
public InputsMonitor(String name, InputsMonitorArgs args, CustomResourceOptions options)

type: splunk:InputsMonitor
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args InputsMonitorArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args InputsMonitorArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args InputsMonitorArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args InputsMonitorArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. InputsMonitorArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var inputsMonitorResource = new Splunk.InputsMonitor("inputsMonitorResource", new()
{
    Acl = new Splunk.Inputs.InputsMonitorAclArgs
    {
        App = "string",
        CanChangePerms = false,
        CanShareApp = false,
        CanShareGlobal = false,
        CanShareUser = false,
        CanWrite = false,
        Owner = "string",
        Reads = new[]
        {
            "string",
        },
        Removable = false,
        Sharing = "string",
        Writes = new[]
        {
            "string",
        },
    },
    Blacklist = "string",
    CrcSalt = "string",
    Disabled = false,
    FollowTail = false,
    Host = "string",
    HostRegex = "string",
    HostSegment = 0,
    IgnoreOlderThan = "string",
    Index = "string",
    Name = "string",
    Recursive = false,
    RenameSource = "string",
    Sourcetype = "string",
    TimeBeforeClose = 0,
    Whitelist = "string",
});
Copy
example, err := splunk.NewInputsMonitor(ctx, "inputsMonitorResource", &splunk.InputsMonitorArgs{
	Acl: &splunk.InputsMonitorAclArgs{
		App:            pulumi.String("string"),
		CanChangePerms: pulumi.Bool(false),
		CanShareApp:    pulumi.Bool(false),
		CanShareGlobal: pulumi.Bool(false),
		CanShareUser:   pulumi.Bool(false),
		CanWrite:       pulumi.Bool(false),
		Owner:          pulumi.String("string"),
		Reads: pulumi.StringArray{
			pulumi.String("string"),
		},
		Removable: pulumi.Bool(false),
		Sharing:   pulumi.String("string"),
		Writes: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	Blacklist:       pulumi.String("string"),
	CrcSalt:         pulumi.String("string"),
	Disabled:        pulumi.Bool(false),
	FollowTail:      pulumi.Bool(false),
	Host:            pulumi.String("string"),
	HostRegex:       pulumi.String("string"),
	HostSegment:     pulumi.Int(0),
	IgnoreOlderThan: pulumi.String("string"),
	Index:           pulumi.String("string"),
	Name:            pulumi.String("string"),
	Recursive:       pulumi.Bool(false),
	RenameSource:    pulumi.String("string"),
	Sourcetype:      pulumi.String("string"),
	TimeBeforeClose: pulumi.Int(0),
	Whitelist:       pulumi.String("string"),
})
Copy
var inputsMonitorResource = new InputsMonitor("inputsMonitorResource", InputsMonitorArgs.builder()
    .acl(InputsMonitorAclArgs.builder()
        .app("string")
        .canChangePerms(false)
        .canShareApp(false)
        .canShareGlobal(false)
        .canShareUser(false)
        .canWrite(false)
        .owner("string")
        .reads("string")
        .removable(false)
        .sharing("string")
        .writes("string")
        .build())
    .blacklist("string")
    .crcSalt("string")
    .disabled(false)
    .followTail(false)
    .host("string")
    .hostRegex("string")
    .hostSegment(0)
    .ignoreOlderThan("string")
    .index("string")
    .name("string")
    .recursive(false)
    .renameSource("string")
    .sourcetype("string")
    .timeBeforeClose(0)
    .whitelist("string")
    .build());
Copy
inputs_monitor_resource = splunk.InputsMonitor("inputsMonitorResource",
    acl={
        "app": "string",
        "can_change_perms": False,
        "can_share_app": False,
        "can_share_global": False,
        "can_share_user": False,
        "can_write": False,
        "owner": "string",
        "reads": ["string"],
        "removable": False,
        "sharing": "string",
        "writes": ["string"],
    },
    blacklist="string",
    crc_salt="string",
    disabled=False,
    follow_tail=False,
    host="string",
    host_regex="string",
    host_segment=0,
    ignore_older_than="string",
    index="string",
    name="string",
    recursive=False,
    rename_source="string",
    sourcetype="string",
    time_before_close=0,
    whitelist="string")
Copy
const inputsMonitorResource = new splunk.InputsMonitor("inputsMonitorResource", {
    acl: {
        app: "string",
        canChangePerms: false,
        canShareApp: false,
        canShareGlobal: false,
        canShareUser: false,
        canWrite: false,
        owner: "string",
        reads: ["string"],
        removable: false,
        sharing: "string",
        writes: ["string"],
    },
    blacklist: "string",
    crcSalt: "string",
    disabled: false,
    followTail: false,
    host: "string",
    hostRegex: "string",
    hostSegment: 0,
    ignoreOlderThan: "string",
    index: "string",
    name: "string",
    recursive: false,
    renameSource: "string",
    sourcetype: "string",
    timeBeforeClose: 0,
    whitelist: "string",
});
Copy
type: splunk:InputsMonitor
properties:
    acl:
        app: string
        canChangePerms: false
        canShareApp: false
        canShareGlobal: false
        canShareUser: false
        canWrite: false
        owner: string
        reads:
            - string
        removable: false
        sharing: string
        writes:
            - string
    blacklist: string
    crcSalt: string
    disabled: false
    followTail: false
    host: string
    hostRegex: string
    hostSegment: 0
    ignoreOlderThan: string
    index: string
    name: string
    recursive: false
    renameSource: string
    sourcetype: string
    timeBeforeClose: 0
    whitelist: string
Copy

InputsMonitor Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The InputsMonitor resource accepts the following input properties:

Acl InputsMonitorAcl
The app/user context that is the namespace for the resource
Blacklist string
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
CrcSalt string
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
Disabled bool
Indicates if input monitoring is disabled.
FollowTail bool
If set to true, files that are seen for the first time is read from the end.
Host string
The value to populate in the host field for events from this data input.
HostRegex string
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
HostSegment int
Use the specified slash-separate segment of the filepath as the host field value.
IgnoreOlderThan string
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
Index string
Which index events from this input should be stored in. Defaults to default.
Name Changes to this property will trigger replacement. string
The file or directory path to monitor on the system.
Recursive bool
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
RenameSource string
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
Sourcetype string
The value to populate in the sourcetype field for incoming events.
TimeBeforeClose int
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
Whitelist string
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
Acl InputsMonitorAclArgs
The app/user context that is the namespace for the resource
Blacklist string
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
CrcSalt string
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
Disabled bool
Indicates if input monitoring is disabled.
FollowTail bool
If set to true, files that are seen for the first time is read from the end.
Host string
The value to populate in the host field for events from this data input.
HostRegex string
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
HostSegment int
Use the specified slash-separate segment of the filepath as the host field value.
IgnoreOlderThan string
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
Index string
Which index events from this input should be stored in. Defaults to default.
Name Changes to this property will trigger replacement. string
The file or directory path to monitor on the system.
Recursive bool
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
RenameSource string
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
Sourcetype string
The value to populate in the sourcetype field for incoming events.
TimeBeforeClose int
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
Whitelist string
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl InputsMonitorAcl
The app/user context that is the namespace for the resource
blacklist String
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crcSalt String
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled Boolean
Indicates if input monitoring is disabled.
followTail Boolean
If set to true, files that are seen for the first time is read from the end.
host String
The value to populate in the host field for events from this data input.
hostRegex String
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
hostSegment Integer
Use the specified slash-separate segment of the filepath as the host field value.
ignoreOlderThan String
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index String
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. String
The file or directory path to monitor on the system.
recursive Boolean
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
renameSource String
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype String
The value to populate in the sourcetype field for incoming events.
timeBeforeClose Integer
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist String
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl InputsMonitorAcl
The app/user context that is the namespace for the resource
blacklist string
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crcSalt string
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled boolean
Indicates if input monitoring is disabled.
followTail boolean
If set to true, files that are seen for the first time is read from the end.
host string
The value to populate in the host field for events from this data input.
hostRegex string
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
hostSegment number
Use the specified slash-separate segment of the filepath as the host field value.
ignoreOlderThan string
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index string
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. string
The file or directory path to monitor on the system.
recursive boolean
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
renameSource string
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype string
The value to populate in the sourcetype field for incoming events.
timeBeforeClose number
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist string
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl InputsMonitorAclArgs
The app/user context that is the namespace for the resource
blacklist str
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crc_salt str
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled bool
Indicates if input monitoring is disabled.
follow_tail bool
If set to true, files that are seen for the first time is read from the end.
host str
The value to populate in the host field for events from this data input.
host_regex str
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
host_segment int
Use the specified slash-separate segment of the filepath as the host field value.
ignore_older_than str
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index str
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. str
The file or directory path to monitor on the system.
recursive bool
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
rename_source str
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype str
The value to populate in the sourcetype field for incoming events.
time_before_close int
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist str
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl Property Map
The app/user context that is the namespace for the resource
blacklist String
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crcSalt String
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled Boolean
Indicates if input monitoring is disabled.
followTail Boolean
If set to true, files that are seen for the first time is read from the end.
host String
The value to populate in the host field for events from this data input.
hostRegex String
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
hostSegment Number
Use the specified slash-separate segment of the filepath as the host field value.
ignoreOlderThan String
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index String
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. String
The file or directory path to monitor on the system.
recursive Boolean
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
renameSource String
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype String
The value to populate in the sourcetype field for incoming events.
timeBeforeClose Number
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist String
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.

Outputs

All input properties are implicitly available as output properties. Additionally, the InputsMonitor resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.

Look up Existing InputsMonitor Resource

Get an existing InputsMonitor resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: InputsMonitorState, opts?: CustomResourceOptions): InputsMonitor
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        acl: Optional[InputsMonitorAclArgs] = None,
        blacklist: Optional[str] = None,
        crc_salt: Optional[str] = None,
        disabled: Optional[bool] = None,
        follow_tail: Optional[bool] = None,
        host: Optional[str] = None,
        host_regex: Optional[str] = None,
        host_segment: Optional[int] = None,
        ignore_older_than: Optional[str] = None,
        index: Optional[str] = None,
        name: Optional[str] = None,
        recursive: Optional[bool] = None,
        rename_source: Optional[str] = None,
        sourcetype: Optional[str] = None,
        time_before_close: Optional[int] = None,
        whitelist: Optional[str] = None) -> InputsMonitor
func GetInputsMonitor(ctx *Context, name string, id IDInput, state *InputsMonitorState, opts ...ResourceOption) (*InputsMonitor, error)
public static InputsMonitor Get(string name, Input<string> id, InputsMonitorState? state, CustomResourceOptions? opts = null)
public static InputsMonitor get(String name, Output<String> id, InputsMonitorState state, CustomResourceOptions options)
resources:  _:    type: splunk:InputsMonitor    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
Acl InputsMonitorAcl
The app/user context that is the namespace for the resource
Blacklist string
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
CrcSalt string
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
Disabled bool
Indicates if input monitoring is disabled.
FollowTail bool
If set to true, files that are seen for the first time is read from the end.
Host string
The value to populate in the host field for events from this data input.
HostRegex string
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
HostSegment int
Use the specified slash-separate segment of the filepath as the host field value.
IgnoreOlderThan string
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
Index string
Which index events from this input should be stored in. Defaults to default.
Name Changes to this property will trigger replacement. string
The file or directory path to monitor on the system.
Recursive bool
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
RenameSource string
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
Sourcetype string
The value to populate in the sourcetype field for incoming events.
TimeBeforeClose int
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
Whitelist string
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
Acl InputsMonitorAclArgs
The app/user context that is the namespace for the resource
Blacklist string
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
CrcSalt string
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
Disabled bool
Indicates if input monitoring is disabled.
FollowTail bool
If set to true, files that are seen for the first time is read from the end.
Host string
The value to populate in the host field for events from this data input.
HostRegex string
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
HostSegment int
Use the specified slash-separate segment of the filepath as the host field value.
IgnoreOlderThan string
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
Index string
Which index events from this input should be stored in. Defaults to default.
Name Changes to this property will trigger replacement. string
The file or directory path to monitor on the system.
Recursive bool
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
RenameSource string
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
Sourcetype string
The value to populate in the sourcetype field for incoming events.
TimeBeforeClose int
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
Whitelist string
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl InputsMonitorAcl
The app/user context that is the namespace for the resource
blacklist String
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crcSalt String
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled Boolean
Indicates if input monitoring is disabled.
followTail Boolean
If set to true, files that are seen for the first time is read from the end.
host String
The value to populate in the host field for events from this data input.
hostRegex String
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
hostSegment Integer
Use the specified slash-separate segment of the filepath as the host field value.
ignoreOlderThan String
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index String
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. String
The file or directory path to monitor on the system.
recursive Boolean
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
renameSource String
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype String
The value to populate in the sourcetype field for incoming events.
timeBeforeClose Integer
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist String
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl InputsMonitorAcl
The app/user context that is the namespace for the resource
blacklist string
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crcSalt string
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled boolean
Indicates if input monitoring is disabled.
followTail boolean
If set to true, files that are seen for the first time is read from the end.
host string
The value to populate in the host field for events from this data input.
hostRegex string
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
hostSegment number
Use the specified slash-separate segment of the filepath as the host field value.
ignoreOlderThan string
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index string
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. string
The file or directory path to monitor on the system.
recursive boolean
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
renameSource string
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype string
The value to populate in the sourcetype field for incoming events.
timeBeforeClose number
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist string
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl InputsMonitorAclArgs
The app/user context that is the namespace for the resource
blacklist str
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crc_salt str
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled bool
Indicates if input monitoring is disabled.
follow_tail bool
If set to true, files that are seen for the first time is read from the end.
host str
The value to populate in the host field for events from this data input.
host_regex str
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
host_segment int
Use the specified slash-separate segment of the filepath as the host field value.
ignore_older_than str
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index str
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. str
The file or directory path to monitor on the system.
recursive bool
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
rename_source str
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype str
The value to populate in the sourcetype field for incoming events.
time_before_close int
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist str
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.
acl Property Map
The app/user context that is the namespace for the resource
blacklist String
Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.
crcSalt String
A string that modifies the file tracking identity for files in this input. The magic value invokes special behavior.
disabled Boolean
Indicates if input monitoring is disabled.
followTail Boolean
If set to true, files that are seen for the first time is read from the end.
host String
The value to populate in the host field for events from this data input.
hostRegex String
Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.
hostSegment Number
Use the specified slash-separate segment of the filepath as the host field value.
ignoreOlderThan String
Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.
index String
Which index events from this input should be stored in. Defaults to default.
name Changes to this property will trigger replacement. String
The file or directory path to monitor on the system.
recursive Boolean
Setting this to false prevents monitoring of any subdirectories encountered within this data input.
renameSource String
The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.
sourcetype String
The value to populate in the sourcetype field for incoming events.
timeBeforeClose Number
When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.
whitelist String
Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.

Supporting Types

InputsMonitorAcl
, InputsMonitorAclArgs

App Changes to this property will trigger replacement. string
The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system
CanChangePerms bool
Indicates if the active user can change permissions for this object. Defaults to true.
CanShareApp bool
Indicates if the active user can change sharing to app level. Defaults to true.
CanShareGlobal bool
Indicates if the active user can change sharing to system level. Defaults to true.
CanShareUser bool
Indicates if the active user can change sharing to user level. Defaults to true.
CanWrite bool
Indicates if the active user can edit this object. Defaults to true.
Owner string
User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.
Reads List<string>
Properties that indicate resource read permissions.
Removable bool
Indicates whether an admin or user with sufficient permissions can delete the entity.
Sharing Changes to this property will trigger replacement. string
Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user
Writes List<string>
Properties that indicate resource write permissions.
App Changes to this property will trigger replacement. string
The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system
CanChangePerms bool
Indicates if the active user can change permissions for this object. Defaults to true.
CanShareApp bool
Indicates if the active user can change sharing to app level. Defaults to true.
CanShareGlobal bool
Indicates if the active user can change sharing to system level. Defaults to true.
CanShareUser bool
Indicates if the active user can change sharing to user level. Defaults to true.
CanWrite bool
Indicates if the active user can edit this object. Defaults to true.
Owner string
User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.
Reads []string
Properties that indicate resource read permissions.
Removable bool
Indicates whether an admin or user with sufficient permissions can delete the entity.
Sharing Changes to this property will trigger replacement. string
Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user
Writes []string
Properties that indicate resource write permissions.
app Changes to this property will trigger replacement. String
The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system
canChangePerms Boolean
Indicates if the active user can change permissions for this object. Defaults to true.
canShareApp Boolean
Indicates if the active user can change sharing to app level. Defaults to true.
canShareGlobal Boolean
Indicates if the active user can change sharing to system level. Defaults to true.
canShareUser Boolean
Indicates if the active user can change sharing to user level. Defaults to true.
canWrite Boolean
Indicates if the active user can edit this object. Defaults to true.
owner String
User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.
reads List<String>
Properties that indicate resource read permissions.
removable Boolean
Indicates whether an admin or user with sufficient permissions can delete the entity.
sharing Changes to this property will trigger replacement. String
Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user
writes List<String>
Properties that indicate resource write permissions.
app Changes to this property will trigger replacement. string
The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system
canChangePerms boolean
Indicates if the active user can change permissions for this object. Defaults to true.
canShareApp boolean
Indicates if the active user can change sharing to app level. Defaults to true.
canShareGlobal boolean
Indicates if the active user can change sharing to system level. Defaults to true.
canShareUser boolean
Indicates if the active user can change sharing to user level. Defaults to true.
canWrite boolean
Indicates if the active user can edit this object. Defaults to true.
owner string
User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.
reads string[]
Properties that indicate resource read permissions.
removable boolean
Indicates whether an admin or user with sufficient permissions can delete the entity.
sharing Changes to this property will trigger replacement. string
Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user
writes string[]
Properties that indicate resource write permissions.
app Changes to this property will trigger replacement. str
The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system
can_change_perms bool
Indicates if the active user can change permissions for this object. Defaults to true.
can_share_app bool
Indicates if the active user can change sharing to app level. Defaults to true.
can_share_global bool
Indicates if the active user can change sharing to system level. Defaults to true.
can_share_user bool
Indicates if the active user can change sharing to user level. Defaults to true.
can_write bool
Indicates if the active user can edit this object. Defaults to true.
owner str
User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.
reads Sequence[str]
Properties that indicate resource read permissions.
removable bool
Indicates whether an admin or user with sufficient permissions can delete the entity.
sharing Changes to this property will trigger replacement. str
Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user
writes Sequence[str]
Properties that indicate resource write permissions.
app Changes to this property will trigger replacement. String
The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system
canChangePerms Boolean
Indicates if the active user can change permissions for this object. Defaults to true.
canShareApp Boolean
Indicates if the active user can change sharing to app level. Defaults to true.
canShareGlobal Boolean
Indicates if the active user can change sharing to system level. Defaults to true.
canShareUser Boolean
Indicates if the active user can change sharing to user level. Defaults to true.
canWrite Boolean
Indicates if the active user can edit this object. Defaults to true.
owner String
User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.
reads List<String>
Properties that indicate resource read permissions.
removable Boolean
Indicates whether an admin or user with sufficient permissions can delete the entity.
sharing Changes to this property will trigger replacement. String
Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user
writes List<String>
Properties that indicate resource write permissions.

Package Details

Repository
Splunk pulumi/pulumi-splunk
License
Apache-2.0
Notes
This Pulumi package is based on the splunk Terraform Provider.
Splunk v1.2.17 published on Wednesday, Apr 9, 2025 by Pulumi
pulumi/pulumi-splunk