https://community.splunk.com/t5/Getting-Data-In/monitor-stanza-help/m-p/49654#M9434 <P>You don't need the '_'. Have you tried this?</P> <P>[monitor:///logs/project1/*Debug*.txt]</P> <P>[monitor:///logs/project1/*Perflog*.txt]</P> Wed, 28 Aug 2013 17:41:20 GMT lukejadamec 2013-08-28T17:41:20Z https://community.splunk.com/t5/Getting-Data-In/monitor-stanza-help/m-p/49653#M9433 <P>Hi.</P> <P>I have a common log path in my server say logs/project1/ which has perflogs and debuglogs i.e like this Appt_Perflog_ms1,Appt_Perflog_ms2 .. ,ABC_Perflog_ms1,ABC_Debug_ms1.txt .. Now i need these logs i.e perflogs to move to perf index and debug to debug index. so for that i have used the following monitor stanza.</P> <PRE><CODE>[monitor:///logs/project1/*_Debug_ms*.txt] blacklist = \.(gz)$ whitelist = ABC_Debug_ms[1-4]{1}.txt$ disabled = false followTail = 0 recursive = false sourcetype = debug_log index = debuglogs [monitor:///logs/project1/*_Perflog_ms*.txt] blacklist = \.(gz)$ whitelist = (Appt_Perflog_ms[1-4]{1}.txt$ | ABC_Perflog_ms[1-4]{1}.txt$ ) disabled = false followTail = 0 recursive = false sourcetype = perf_log index = perflogs </CODE></PRE> <P>but this seems to be not working ?? any clue what happened here ?? is the <EM>**_</EM>* in monitor stanza causing this issue..pls help me..</P> Mon, 28 Sep 2020 14:40:28 GMT https://community.splunk.com/t5/Getting-Data-In/monitor-stanza-help/m-p/49653#M9433 rakesh_498115 2020-09-28T14:40:28Z https://community.splunk.com/t5/Getting-Data-In/monitor-stanza-help/m-p/49654#M9434 <P>You don't need the '_'. Have you tried this?</P> <P>[monitor:///logs/project1/*Debug*.txt]</P> <P>[monitor:///logs/project1/*Perflog*.txt]</P> Wed, 28 Aug 2013 17:41:20 GMT https://community.splunk.com/t5/Getting-Data-In/monitor-stanza-help/m-p/49654#M9434 lukejadamec 2013-08-28T17:41:20Z