https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70744#M14396 <P>Maybe its the page stripping the characters but you Are using<BR /> <CODE>pqr*\.log$</CODE> with the asterisk (*) and the slash ()?</P> Thu, 20 Jun 2013 19:58:32 GMT JSapienza 2013-06-20T19:58:32Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70741#M14393 <P>Let's say I have the following in my inputs.conf file:</P> <P>[monitor:///splunk/splink/fish/abc_qa/logs/]</P> <P>whitelist = def*.log$|ghi*.log$|jkl*.log$|mno*.log$|pqr*.log$</P> <P>sourcetype = applogs</P> <P>index = risk</P> <P>disabled = false</P> <P>crcSalt=<SOURCE></SOURCE></P> <P>And the directory contains the following files:</P> <P>def_QA_BOAT.log</P> <P>ghi_QA_TROUT.log</P> <P>pqr_QA_worm_count.log</P> <P>Why don't any of these match?</P> Mon, 28 Sep 2020 14:08:40 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70741#M14393 jcmaynard 2020-09-28T14:08:40Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70742#M14394 <P>try this:<BR /> <CODE>whitelist = def*\.log$|ghi*\.log$|jkl*\.log$|mno*\.log$|pqr*\.log$</CODE></P> Thu, 20 Jun 2013 19:37:35 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70742#M14394 JSapienza 2013-06-20T19:37:35Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70743#M14395 <P>It tells me nothing matches 'def*.log|ghi*.log|...'. Wouldn't it come back with '_' in the name?</P> Mon, 28 Sep 2020 14:08:43 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70743#M14395 jcmaynard 2020-09-28T14:08:43Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70744#M14396 <P>Maybe its the page stripping the characters but you Are using<BR /> <CODE>pqr*\.log$</CODE> with the asterisk (*) and the slash ()?</P> Thu, 20 Jun 2013 19:58:32 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70744#M14396 JSapienza 2013-06-20T19:58:32Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70745#M14397 <P>using asterisk and slash plus '|' between each file name.</P> Thu, 20 Jun 2013 20:01:07 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70745#M14397 jcmaynard 2013-06-20T20:01:07Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70746#M14398 <P>I've attempted the above with just the slashes (without the asterisks) and it still doesn't work.</P> Fri, 21 Jun 2013 14:20:56 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70746#M14398 jcmaynard 2013-06-21T14:20:56Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70747#M14399 <P>I've attempted the above with just the slashes (without the asterisks) and it still doesn't work.</P> Fri, 21 Jun 2013 14:21:13 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70747#M14399 jcmaynard 2013-06-21T14:21:13Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70748#M14400 <P>I've attempted the above with just the slashes (without the asterisks) and it still doesn't work.</P> Fri, 21 Jun 2013 14:21:29 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70748#M14400 jcmaynard 2013-06-21T14:21:29Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70749#M14401 <P>If you are only specifying the first few characters of the file name you must have the asterisk to wildcard the rest of the file name. You must also have the slash to escape the dot before the file extension. Have you tried using only one expression without the OR "|" ?</P> Fri, 21 Jun 2013 14:52:45 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70749#M14401 JSapienza 2013-06-21T14:52:45Z https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70750#M14402 <P>Tried this also with just a single expression in the following format: abc*.log$. No dice. What am I missing?</P> Fri, 21 Jun 2013 17:27:06 GMT https://community.splunk.com/t5/Getting-Data-In/Underscores-in-inputs-conf-HELP/m-p/70750#M14402 jcmaynard 2013-06-21T17:27:06Z