https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-filename-with-timestamp/m-p/475163#M99720 <P>In your inputs.conf monitor stanza you can use wildcards:</P> <PRE><CODE>[monitor:///var/log/homerun-*] index = foo sourcetype = bar etc. </CODE></PRE> Sat, 04 Jan 2020 15:51:22 GMT martin_mueller 2020-01-04T15:51:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-filename-with-timestamp/m-p/475162#M99719 <P>I have a custom application and the log gets created at 7:00 UTC every day. The log file will have timestamp in the filename. How do I configure the forwarder to send the file to Splunk indexer?</P> <P>Example: /var/log/homerun-20200104.</P> Sat, 04 Jan 2020 15:25:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-filename-with-timestamp/m-p/475162#M99719 riyastk 2020-01-04T15:25:18Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-filename-with-timestamp/m-p/475163#M99720 <P>In your inputs.conf monitor stanza you can use wildcards:</P> <PRE><CODE>[monitor:///var/log/homerun-*] index = foo sourcetype = bar etc. </CODE></PRE> Sat, 04 Jan 2020 15:51:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarder-filename-with-timestamp/m-p/475163#M99720 martin_mueller 2020-01-04T15:51:22Z