Getting Data In

How to configure stanzas in inputs.conf to monitor two paths with the same folder names, but are case sensitive?

rsathish47
Contributor

Hi All,

I need to configure inputs.conf for the folder path below. Can we do it in one stanza, or do we need create two different stanzas?
The difference between the two paths is the log folder name. In some servers, it is in lower case and in some servers it is in upper case.

Folder Path:

d:\Logs\TV_Engine.log
d:\logs\TV_Engine.log

Thanks
Sathish R

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

I think it is OS dependent, so since you are on Windows, you might only need one stanza.

I would use a single stanza, but I would do it like this:

[monitor://D:\*\TV_Engine.log]
sourcetype = tv_engine

This way doesn't matter what the folder is, as long as the file TV_Engine.log is 1 Folder down from D:\.

rsathish47
Contributor

thank you @alacercogitatus
i thought the same.

i tried below but not worked

 [monitor://d:\(l|L)ogs\TV_Engine.log]
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Input stanzas cannot use Regex. * is a special character in this case.

0 Karma

rsathish47
Contributor

can we use like this
[monitor://d:\*ogs\TV_Engine.log]

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability - October 2025

What’s New?  We’re excited to announce the latest enhancements to Splunk Observability Cloud and share what’s ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened Audit Trail v2 wasn’t written in isolation—it was shaped by your voices. In ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...