topic Re: Input.Conf with Version numbers in Getting Data In

Input.Conf with Version numbers

Cheng2Ready — Tue, 15 Jul 2025 22:09:19 GMT

[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.0.71\logs\*]
disabled = false
host = NJROS1BVA0621
alwaysOpenFile = 1
sourcetype = Image Importer Logs

Is there a way to add a Wild card for any upcoming version updates like below? will this work?

[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.*\logs\*]

Or does it have to be like this?

[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.[0-9].[0-9][0-9]\logs\*]

Re: Input.Conf with Version numbers

PrewinThomas — Wed, 16 Jul 2025 04:24:27 GMT

@Cheng2Ready

You can use wildcard for future versions of 9 with the below,
Eg:
[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.*\logs\*]
disabled = false
host = NJROS1BVA0621
alwaysOpenFile = 1
sourcetype = Image Importer Logs

But i'm just curious that you have alwaysOpenFile = 1, I hope you have valid reason for the same.
Just FYI - Enabling this option increases resource consumption and can slow down indexing.
#https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/Inputsconf

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Input.Conf with Version numbers

livehybrid — Wed, 16 Jul 2025 06:19:30 GMT

Hi @Cheng2Ready

You can use a * for any value in the current directory/segment or ... to recursively wildcard. Therefore you can do the following:

[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.*\logs\*] disabled = false host = NJROS1BVA0621 alwaysOpenFile = 1 sourcetype = Image Importer Logs

Check out https://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards for more info on this and https://community.splunk.com/t5/Getting-Data-In/What-is-the-proper-use-of-wildcard-in-a-file-monitor-path/m-p/347282 for other good examples.

Is there any particular reason you're using alwaysOpenFile=1? This is only useful for files that do not update modification time or size and adds resource overhead, so wanted to check.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Input.Conf with Version numbers

Cheng2Ready — Wed, 16 Jul 2025 19:41:00 GMT

Thank you @PrewinThomas

I see yeah I just copied somonelses post for thier input.conf example

https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-with-wildcards/m-p/59916

but my main focus was the Monitor line

Re: Input.Conf with Version numbers

Cheng2Ready — Wed, 16 Jul 2025 19:42:05 GMT

Thank you @livehybrid

I see yeah I just copied someone else post for their input.conf example

https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-with-wildcards/m-p/59916

but my main focus was the Monitor line

Re: Input.Conf with Version numbers

Cheng2Ready — Wed, 16 Jul 2025 19:46:42 GMT

@livehybrid
Just confirming Will it capture

warcraft-9.0.78\logs\*

Re: Input.Conf with Version numbers

Cheng2Ready — Wed, 16 Jul 2025 19:46:58 GMT

@PrewinThomas

Just confirming Will it capture

warcraft-9.0.78\logs\*