I'm using a deployment server to distribute a single inputs.conf file to a number of servers in a class. The locations of the files that I need to monitor are similar between the servers, but sometimes (sub)directories refer to the servers instead of being generically named. This circumstance made me reach for wildcards / whitelists in determining the paths of the files to watch. (The alternative would be creating separate monitor stanzas for each individual server in the class, which defeats the purpose.) Can't get it to work, though. What am I missing?
These are the directories / files on the various servers I want to monitor:
And these are the monitor stanzas I'd set up in inputs.conf:
Unfortunately this does not work...
Checking the _internal index made clear that the monitor stanzas are not OK. Apparently implicit whitelists were added:
'^\/base\/logs\/appl/[^/]*.seg.ex/logfile1.log$' (on path 'monitor:///base/logs/appl') 
'^\/base\/logs\/appl/[^/]*.seg.ex/logfile2.log$' (on path 'monitor:///base/logs/appl') 
The _internal index also contains logevents saying:
TailingProcessor - Will not call watch on path '/base/logs/appl/xxx.seg.ex/logfile1.log due to stanza: monitor:///base/logs/appl/*.seg.ex/logfile1.log 
TailingProcessor - Will not call watch on path '/base/logs/appl/xxx.seg.ex/logfile2.log due to stanza: monitor:///base/logs/appl/*.seg.ex/logfile1.log 
Why doesn't this work? And how could I get it to work as desired?
The problem is that because of the wildcard, you are telling the forwarder to essentially monitor the same directory and files, but send them to two different indexes.
You'll need to further delimit the directory or file names being monitored so that they are unique.
Splunk can send the same file to two different indexes, but not using the configuration that you have in place.
I'm not sure what your filesystem structure looks like, but it could be a recursive issue.
Try using this:
Tried inputs.conf with only one monitor stanza, which I also simplified by replacing a whole segment of the path with an * (instead using the wildcard for a part of a segment):
This configuration is almost exactly the same as one shown in the examples here: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Specifyinputpathswithwildcards
Strangely, it still doen't work. The same / similar errors in _internal.
Tried inputs.conf without the second monitor stanza, so there was only:
Didn't work; the same / similar events pop up in the _internal index.