https://community.splunk.com/t5/Getting-Data-In/inputs-conf-behaviour-doesn-t-corespond-with-documentation/m-p/63371#M12715 <P>thx the refrence articel answers my qustion</P> Thu, 10 Nov 2011 13:47:57 GMT Christian 2011-11-10T13:47:57Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-behaviour-doesn-t-corespond-with-documentation/m-p/63369#M12713 <P>Hello all, </P> <P>my direcotry structur :</P> <PRE><CODE>/data/A/logs/aaaaaaa.log /data/A/logs/aaaaaaa1.log /data/B/logs/aaaaaaa.log /data/B/logs/aaaaaaa1.log </CODE></PRE> <P>my inputs.conf </P> <PRE><CODE>[monitor:///data/*/logs] sourcetype=mysourcetype index=idx_myindex_dev disabled=false </CODE></PRE> <P>A) If I'am putting the Fullpath "for example /data/A/logs/" to the monitor field it works fine <BR /><BR /> B) If I try it with the inputs.conf above, he lists me only the directorys, but doesn't index any file. In the Splunkd.log he says Parsing configuration stanza: monitor:///data/*/logs. No error, no information.</P> <P>According to the Documentation :<BR />`The asterisk (<EM>) matches anything in a single path segment;<BR /> unlike "...", it does not recurse. For example, <BR /> /foo/</EM>/bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, <BR /> etc. However, it does not match /foo/1/2/bar.</P> <P>wich is fine for me, anyway I tried it also with the <A href="https://answers.splunk.comdata/.../logs">...</A> witch would be also fine for me but that doesn't work either.</P> <P>Q : Any Idea what I'am doing wrong ? <BR /></P> <P>Universalforwarder : 4.2.3 <BR /><BR /> OS : AIX 6.1<BR /><BR /> Documentation : <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf</A></P> Wed, 24 Aug 2011 12:05:14 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-behaviour-doesn-t-corespond-with-documentation/m-p/63369#M12713 Christian 2011-08-24T12:05:14Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-behaviour-doesn-t-corespond-with-documentation/m-p/63370#M12714 <P>I think you'll find a very detailed explanation here ... <A href="http://splunk-base.splunk.com/answers/2775/regexs-and-windows-paths-in-inputsconf-and-propsconf">http://splunk-base.splunk.com/answers/2775/regexs-and-windows-paths-in-inputsconf-and-propsconf</A></P> Wed, 24 Aug 2011 17:29:20 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-behaviour-doesn-t-corespond-with-documentation/m-p/63370#M12714 rroberts 2011-08-24T17:29:20Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-behaviour-doesn-t-corespond-with-documentation/m-p/63371#M12715 <P>thx the refrence articel answers my qustion</P> Thu, 10 Nov 2011 13:47:57 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-behaviour-doesn-t-corespond-with-documentation/m-p/63371#M12715 Christian 2011-11-10T13:47:57Z