Wildcard ... not working in my stanza

daymar_23 — Mon, 27 Sep 2021 15:28:47 GMT

Hello All:

I have problems with my application where I am configuring the following stanza in the inputs.config file (C:\Program Files\SplunkUniversalForwarder\etc\apps\ope_web_api\default):

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Specifyinputpathswithwildcards

[monitor://D:\package\...\version\Admin\APIS\log]
disabled = 0
index = ope_web_api
sourcetype = api_logs
ignoreOlderThan = 1d

I have Splunk Cloud 8.2.2 version.

If I change the ... by the name of the file it works fine:

[monitor://D:\package\ABC\version\Admin\APIS\log]
disabled = 0
index = ope_web_api
sourcetype = api_logs
ignoreOlderThan = 1d

But I need the ... because not always is the same file name.

Does somebody know what I am missing here?

Regards.

Re: Wildcard ... not working in my stanza

Azeemering — Fri, 01 Oct 2021 11:49:28 GMT

Have you tried [monitor://D:\package\*\version\Admin\APIS\log]

Example from the docs Specify input paths with wildcards - Splunk Documentation

To monitor /apache/foo/logs, /apache/bar/logs, but not /apache/bar/1/logs or /apache/bar/2/logs, create the following stanza:

[monitor:///apache/*/logs]

topic Wildcard ... not working in my stanza in Getting Data In

Wildcard ... not working in my stanza

Re: Wildcard ... not working in my stanza