https://community.splunk.com/t5/Getting-Data-In/monitoring-a-specific-file-through-subdirectories/m-p/63015#M12652 <P>I would aim the monitor at the higher level common directory and whitelist.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata</A></P> <P>Example:<BR /> [monitor:///data1/logs/]<BR /> whitelist = logfileyouwant.log</P> <P>That should just grab that file name regardless where it shows up in all the different subdirectories under /data1/logs/</P> Fri, 15 Mar 2013 19:19:39 GMT starcher 2013-03-15T19:19:39Z https://community.splunk.com/t5/Getting-Data-In/monitoring-a-specific-file-through-subdirectories/m-p/63014#M12651 <P>Hi,</P> <P>How would I tell splunk to monitor a specific file through a set of subdirectories? Would I set a wildcard in the monitor statement? Should I use a whitelist? </P> Fri, 15 Mar 2013 13:57:31 GMT https://community.splunk.com/t5/Getting-Data-In/monitoring-a-specific-file-through-subdirectories/m-p/63014#M12651 a212830 2013-03-15T13:57:31Z https://community.splunk.com/t5/Getting-Data-In/monitoring-a-specific-file-through-subdirectories/m-p/63015#M12652 <P>I would aim the monitor at the higher level common directory and whitelist.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata</A></P> <P>Example:<BR /> [monitor:///data1/logs/]<BR /> whitelist = logfileyouwant.log</P> <P>That should just grab that file name regardless where it shows up in all the different subdirectories under /data1/logs/</P> Fri, 15 Mar 2013 19:19:39 GMT https://community.splunk.com/t5/Getting-Data-In/monitoring-a-specific-file-through-subdirectories/m-p/63015#M12652 starcher 2013-03-15T19:19:39Z