Getting Data In

Can you help me with wildcard usage in the inputs.conf monitoring path?

damucka
Builder

Hello,

I have the following paths to monitor:

[monitor:///usr/sap/ICP/D15/work/dev_*]
[monitor:///usr/sap/ICP/ASCS14/work/dev_*]

For the several logfile patterns, like dev_*, vmc*, etc.

My idea is to create a separate monitoring entries for each logfile pattern together with the whitelist of it.

However, in order to avoid doubling for the D15 and ASCS15, is it possible to use the wildcards in the monitored path for that?

Like for the example below to use * in the path having sth. as below:

[monitor:///usr/sap/ICP/*/work/dev_*]

Kind Regards,
Kamil

0 Karma
1 Solution

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

View solution in original post

0 Karma

woodcock
Esteemed Legend

If you have 2 monitor stanzas that match the same file, you will only forward one copy of it so keep your configurations simple and don't worry about it.

0 Karma

FrankVl
Ultra Champion

Both * and ... should work in this case. ... also works if there are more levels of subdirectories, * doesn't match / so only works for 1 level.

0 Karma

damucka
Builder

Would tha be:
[monitor:///usr/sap/ICP/.../dev_*]

?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...