topic Re: windows wildcard path name bug in Getting Data In

windows wildcard path name bug

nowakdaw — Mon, 22 Oct 2012 20:51:48 GMT

Hello All,

I searched on answers but I can't seem to come up with a clear answer. Has anyone figured out a workaround for the "Warning: In Windows, you cannot currently use a wildcard at the root level. For example, this does not work:[monitor://E:\...\foo\*.log]" from http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards

I am attempting to forward log files using wildcards in my monitor names. I am using Splunk version 4.3.2. Thank you for your help.

Re: windows wildcard path name bug

lguinn2 — Wed, 24 Oct 2012 03:40:39 GMT

Well, I would guess that you could use

[monitor://E:\dir1\...\foo\*.log]

[monitor://E:\dir2\...\foo\*.log]

[monitor://E:\dir3\...\foo\*.log]

etc.

But there are probably other work-arounds as well. What directories do you want to monitor? Can you give us more details on what you are trying to do?

Re: windows wildcard path name bug

nowakdaw — Thu, 25 Oct 2012 13:17:51 GMT

Thank you all for your help. I accomplished this by pointing to the specific folder explicitly and then using whitelists to get the necessary logs out.@lguinn, thank you. @jkat54 Thank you, I also try this and see if it works.