The current log file name I have is: catalina.2010-02-24.log.

I want to add this for splunk indexing, but i am running into problems, since there is no static file name, since everyday tomcat renames the log file.

[tail:///var/logs/catalina.2010-02-24.log] is not gonna work. Is there a way around this problem

2 Answers 2


You can index either the whole directory, or use wildcards to select the appropriate files.

In your case, [monitor://var/logs/catalina.*.log] should work correctly.


You could add a script that runs as a daily cron job which symlinks the file based on the date to catalina.current.log or something such as this.


ln -sf /var/logs/catalina.`date +%Y-%m-%d`.log /var/logs/catalina.current.log

Then of course just use catalina.current.log to access the current day's log.

  • Disclaimer: I know nothing about Splunk, so this may cause problems. Feb 24, 2010 at 22:49
  • You could also index /var/logs/catalina.*.log I believe. Or put the logs in /var/logs/catalina and monitor this directory. Feb 24, 2010 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.