https://community.splunk.com/t5/Getting-Data-In/inputs-conf-configuration-help/m-p/56002#M10943 <P>I think you'd better work with whitelists/blacklists in this case. I don't think that <CODE>[monitor]</CODE> stanza header can make use of full regexes.</P> <PRE><CODE>[monitor:///splunkInput/logs] sourcetype = blaha index = blaha whitelist = Managed1\d?\.log </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> Mon, 10 Sep 2012 19:01:56 GMT kristian_kolb 2012-09-10T19:01:56Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-configuration-help/m-p/56001#M10942 <P>Hi.</P> <P>I have source files in the following folder </P> <P>path : <STRONG>splunkInput/logs/</STRONG></P> <P>Files in the path are <BR /> Managed1.txt<BR /> Managed2.txt<BR /> Managed3.txt<BR /> Managed4.txt<BR /> ....<BR /> ....<BR /> ....</P> <P>Managed50.txt</P> <P>I have 50 Files like this..</P> <P>Now i have given this configuration in inputs.conf to index only first ten files..ie.Managed1.txt to Managed10.txt.</P> <P>So i have like this in inputs.conf</P> <H2>inputs.conf</H2> <P>[monitor:///splunkInput/logs/Managed[1-10]{2}.txt]<BR /> disable=false<BR /> sourcetype=mydata</P> <P>but this is not working ..can u help the correct regex expression for this sceneraio.</P> <P>Thanx</P> Mon, 10 Sep 2012 18:41:36 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-configuration-help/m-p/56001#M10942 rakesh_498115 2012-09-10T18:41:36Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-configuration-help/m-p/56002#M10943 <P>I think you'd better work with whitelists/blacklists in this case. I don't think that <CODE>[monitor]</CODE> stanza header can make use of full regexes.</P> <PRE><CODE>[monitor:///splunkInput/logs] sourcetype = blaha index = blaha whitelist = Managed1\d?\.log </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> Mon, 10 Sep 2012 19:01:56 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-configuration-help/m-p/56002#M10943 kristian_kolb 2012-09-10T19:01:56Z