https://community.splunk.com/t5/Getting-Data-In/multiple-monitor-for-same-directory/m-p/59264#M11675 <P>The monitor stanzas will be in inputs.conf and you can edit the file directly rather than use the UI but that should work as well. You could just use the following and splunk will monitor all files in that directory. </P> <P>[monitor://C:Documents and Settings\attgjh1\Desktop\test]</P> <P>You can also use wildcards<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards">http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards</A></P> <P>If there are files you don't want you can use a blacklist like this.</P> <P>/#i want to ignore zipped files<BR /> blacklist = .(gz|bz2|z|zip)$</P> Thu, 24 May 2012 10:36:26 GMT sdaniels 2012-05-24T10:36:26Z https://community.splunk.com/t5/Getting-Data-In/multiple-monitor-for-same-directory/m-p/59263#M11674 <P>I am attempting to read different types of log into various sources. But all the logs belong in the same directory and i cannot have multiple monitors in them</P> <P>the various logs are located at desktop\test\</P> <OL> <LI>pulsar_handler_machineid.2012-05-28-(hour)</LI> <LI>inbound_handler_machineid.2012-05-28-(hour)</LI> <LI>outbound_handler... etc</LI> </OL> <P>My initial attempt involved only using websplunk but i realised we cannot have more than one monitor on the same directory. </P> <P>i tried with inputs.conf<BR /><BR /> [monitor://C:\Documents and Settings\attgjh1\Desktop\test\pulsar*]<BR /><BR /> disabled = false<BR /><BR /> followTail = 0<BR /><BR /> sourcetype = pulsar</P> <P>the same settings were also created for the other logs.<BR /> however, splunk did not index any of the logs at all. (even after restarting)</P> <P>im fairly new to using props.conf and inputs.conf to do stuffs. <BR /> can someone help me? thanks!</P> Thu, 24 May 2012 08:47:56 GMT https://community.splunk.com/t5/Getting-Data-In/multiple-monitor-for-same-directory/m-p/59263#M11674 attgjh1 2012-05-24T08:47:56Z https://community.splunk.com/t5/Getting-Data-In/multiple-monitor-for-same-directory/m-p/59264#M11675 <P>The monitor stanzas will be in inputs.conf and you can edit the file directly rather than use the UI but that should work as well. You could just use the following and splunk will monitor all files in that directory. </P> <P>[monitor://C:Documents and Settings\attgjh1\Desktop\test]</P> <P>You can also use wildcards<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards">http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards</A></P> <P>If there are files you don't want you can use a blacklist like this.</P> <P>/#i want to ignore zipped files<BR /> blacklist = .(gz|bz2|z|zip)$</P> Thu, 24 May 2012 10:36:26 GMT https://community.splunk.com/t5/Getting-Data-In/multiple-monitor-for-same-directory/m-p/59264#M11675 sdaniels 2012-05-24T10:36:26Z