https://community.splunk.com/t5/Splunk-Search/Splunk-Tailing-Errors/m-p/97168#M182572 <P>ok, my sources use syntax like \dir\dir\...\log so that it recursively finds all of my log files.</P> <P>but now i see this in Splunk errors report (splunk v4.3.1 for linux)</P> <P>03-19-2012 13:11:32.755 -0400 ERROR TailingProcessor - matching /logs/syslog/ironports/hostA/2012/03/ against ^/logs/syslog/ironports/.*/log$</P> <OL> <LI>so why the tailing error? kinda a silly event as it gives no info as to what the error was.</LI> <LI>why does this report show a modified regex for the dir path? me personally, i dont like configs to look like one thing in one place and something else in another place. so instead of using ... in my source paths i should use .* ?? (question marks to indicate this is a question, etc)</LI> </OL> Tue, 20 Mar 2012 13:26:46 GMT cvajs 2012-03-20T13:26:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-Tailing-Errors/m-p/97168#M182572 <P>ok, my sources use syntax like \dir\dir\...\log so that it recursively finds all of my log files.</P> <P>but now i see this in Splunk errors report (splunk v4.3.1 for linux)</P> <P>03-19-2012 13:11:32.755 -0400 ERROR TailingProcessor - matching /logs/syslog/ironports/hostA/2012/03/ against ^/logs/syslog/ironports/.*/log$</P> <OL> <LI>so why the tailing error? kinda a silly event as it gives no info as to what the error was.</LI> <LI>why does this report show a modified regex for the dir path? me personally, i dont like configs to look like one thing in one place and something else in another place. so instead of using ... in my source paths i should use .* ?? (question marks to indicate this is a question, etc)</LI> </OL> Tue, 20 Mar 2012 13:26:46 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Tailing-Errors/m-p/97168#M182572 cvajs 2012-03-20T13:26:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-Tailing-Errors/m-p/97169#M182573 <P>The reason for the second one is that Splunk uses PCRE internally to implement the filters. The log message reflects the regex as used internally.</P> Tue, 20 Mar 2012 14:09:41 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Tailing-Errors/m-p/97169#M182573 dart 2012-03-20T14:09:41Z