https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-whitelist-syntax-assistance/m-p/106760#M22458 <P>I have several virtual hosts under /opt/log/</P> <P>/opt/log/webA<BR /><BR /> /opt/log/webB<BR /><BR /> /opt/log/webC</P> <P>They all have denied.log that I need to index, would this be correct inputs.conf?</P> <P>[monitor:///opt/log/www*]<BR /><BR /> sourcetype = apache<BR /><BR /> index=www<BR /><BR /> host_segment=3<BR /><BR /> whitelist = denied\.log$ </P> Fri, 26 Apr 2013 00:07:12 GMT splunkingsplun1 2013-04-26T00:07:12Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-whitelist-syntax-assistance/m-p/106760#M22458 <P>I have several virtual hosts under /opt/log/</P> <P>/opt/log/webA<BR /><BR /> /opt/log/webB<BR /><BR /> /opt/log/webC</P> <P>They all have denied.log that I need to index, would this be correct inputs.conf?</P> <P>[monitor:///opt/log/www*]<BR /><BR /> sourcetype = apache<BR /><BR /> index=www<BR /><BR /> host_segment=3<BR /><BR /> whitelist = denied\.log$ </P> Fri, 26 Apr 2013 00:07:12 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-whitelist-syntax-assistance/m-p/106760#M22458 splunkingsplun1 2013-04-26T00:07:12Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-whitelist-syntax-assistance/m-p/106761#M22459 <P>This worked:</P> <P>[monitor:///opt/log/*]<BR /><BR /> index=web<BR /><BR /> host_segment=3<BR /><BR /> sourcetype = apache<BR /><BR /> index=www <BR /> whitelist = access.log$</P> Fri, 26 Apr 2013 01:29:10 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-whitelist-syntax-assistance/m-p/106761#M22459 splunkingsplun1 2013-04-26T01:29:10Z