topic Re: Wildcard not working in monitor input in Splunk Search

Wildcard not working in monitor input

reach2tushar — Tue, 29 Sep 2020 12:48:13 GMT

I used following syntax to monitor a file input in windows
[monitor://D:\app*\logs\a*.log]
The above stanza is not indexing any file. Getting the below error in splnkd.log on forwarder
FilesystemChangeWatcher - error getting attributes of path "\D:": The filename, directory name, or volume label syntax is incorrect.

But when I use following input, it works.
[monitor://D:\appdev\logs\a*.log]

Please help.

Re: Wildcard not working in monitor input

sassens1 — Thu, 09 Feb 2017 08:40:13 GMT

Hi,

can you try this

 [monitor://D:\app*\log\]
 index = <your_index>
 sourcetype = <your_sourcetype>
 whitelist = a*\.log$

Re: Wildcard not working in monitor input

reach2tushar — Tue, 29 Sep 2020 12:48:58 GMT

Thanks for the reply.
It's not working. The reason is that I provided wildcard just after the drive D:\app*\log. when we provide an input like following, it works.
[monitor://D:\appdev\l*]

Please confirm if there is any other way to provide wildcard to a folder after D:\

Re: Wildcard not working in monitor input

sassens1 — Thu, 09 Feb 2017 12:07:58 GMT

well

you can also play with the path, can you change the directory to something like D:\newdir\appxxx and then recursively monitor the newdir ?

  [monitor://D:\...\log\a*.log]
  whitelist =  D:\app*\

Re: Wildcard not working in monitor input

reach2tushar — Thu, 09 Feb 2017 12:57:39 GMT

No, we cannot change the directory as it is on forwarder and it is generated by an application.

Re: Wildcard not working in monitor input

woodcock — Tue, 21 Feb 2017 22:34:20 GMT

Try this:

[monitor://D:\*\log\a*.log]
whitelist = D:\app*\log\a*.log

Re: Wildcard not working in monitor input

reach2tushar — Wed, 22 Feb 2017 07:42:46 GMT

Hi, Thanks for the reply.
The wildcard just after the root directory is not working in Splunk. Could you please check at your end if this works?