https://community.splunk.com/t5/Getting-Data-In/Deployment-app-wildcard-Issue-with-inputs-conf-file-on-windows/m-p/258526#M49649 <P>We have multiple forwarders running on Windows servers that need to monitor application log directories. The only difference in each log path, is one segment.</P> <P>For Example:</P> <P>D:\abc\tra\domain\CPWCLPRD\application\logs\<BR /> D:\abc\tra\domain\CPWULPRD\application\logs\<BR /> D:\abc\tra\domain\SSSCQA\application\logs\</P> <P>When the path is explicitly defined, the monitor works. However, I have been trying to use the following monitor in the inputs.conf file, but it doesn't work as soon as I put the "..." wildcard in.</P> <PRE><CODE>[monitor://D:\abc\tra\domain\\...\application\logs\] disabled = false ignoreOlderThan = 7d sourcetype = abc_defghi index = xyz_funding </CODE></PRE> Wed, 30 Nov 2016 14:58:40 GMT rcrook89 2016-11-30T14:58:40Z https://community.splunk.com/t5/Getting-Data-In/Deployment-app-wildcard-Issue-with-inputs-conf-file-on-windows/m-p/258526#M49649 <P>We have multiple forwarders running on Windows servers that need to monitor application log directories. The only difference in each log path, is one segment.</P> <P>For Example:</P> <P>D:\abc\tra\domain\CPWCLPRD\application\logs\<BR /> D:\abc\tra\domain\CPWULPRD\application\logs\<BR /> D:\abc\tra\domain\SSSCQA\application\logs\</P> <P>When the path is explicitly defined, the monitor works. However, I have been trying to use the following monitor in the inputs.conf file, but it doesn't work as soon as I put the "..." wildcard in.</P> <PRE><CODE>[monitor://D:\abc\tra\domain\\...\application\logs\] disabled = false ignoreOlderThan = 7d sourcetype = abc_defghi index = xyz_funding </CODE></PRE> Wed, 30 Nov 2016 14:58:40 GMT https://community.splunk.com/t5/Getting-Data-In/Deployment-app-wildcard-Issue-with-inputs-conf-file-on-windows/m-p/258526#M49649 rcrook89 2016-11-30T14:58:40Z https://community.splunk.com/t5/Getting-Data-In/Deployment-app-wildcard-Issue-with-inputs-conf-file-on-windows/m-p/258527#M49650 <P>I figured out the resolution on this. </P> <P>It looks like a bug was fixed in 6.5.1. that resolves an issue with using wildcards in the file monitor for an inputs.conf file.</P> <P>In 6.5, for windows, you have to specify ".." as the wildcard in an inputs.conf monitor. </P> <P>In 6.5.1, for windows, you can specify "..." in an inputs.conf file as the wildcard (per Splunk's documentation).</P> Wed, 30 Nov 2016 22:42:06 GMT https://community.splunk.com/t5/Getting-Data-In/Deployment-app-wildcard-Issue-with-inputs-conf-file-on-windows/m-p/258527#M49650 rcrook89 2016-11-30T22:42:06Z