Input.Conf with Version numbers

[Cheng2Ready]

[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.0.71\logs\*]
disabled = false
host = NJROS1BVA0621
alwaysOpenFile = 1
sourcetype = Image Importer Logs

Is there a way to add a Wild card for any upcoming version updates like below? will this work?


[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.*\logs\*]

Or does it have to be like this?

[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.[0-9].[0-9][0-9]\logs\*]

[livehybrid]

Hi @Cheng2Ready 

You can use a * for any value in the current directory/segment or ... to recursively wildcard. Therefore you can do the following:

[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.*\logs\*]
disabled = false
host = NJROS1BVA0621
alwaysOpenFile = 1
sourcetype = Image Importer Logs

Check out https://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards for more info on this and https://community.splunk.com/t5/Getting-Data-In/What-is-the-proper-use-of-wildcard-in-a-file-monitor... for other good examples.

Is there any particular reason you're using alwaysOpenFile=1? This is only useful for files that do not update modification time or size and adds resource overhead, so wanted to check.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Cheng2Ready]

@livehybrid 
Just confirming Will it capture

warcraft-9.0.78\logs\*

[Cheng2Ready]

Thank you @livehybrid 

I see yeah I just copied someone else post for their input.conf example

https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-with-wildcards/m-p/59916

but my main focus was the Monitor line

[PrewinThomas · Accepted solution]

@Cheng2Ready 

You can use wildcard for future versions of 9 with the below,
Eg:
[monitor://\\njros1bva0597\d$\LogFiles\warcraft-9.*\logs\*]
disabled = false
host = NJROS1BVA0621
alwaysOpenFile = 1
sourcetype = Image Importer Logs

But i'm just curious that you have alwaysOpenFile = 1, I hope you have valid reason for the same.
Just FYI - Enabling this option increases resource consumption and can slow down indexing.
#https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/Inputsconf

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[Cheng2Ready]

@PrewinThomas 

Just confirming Will it capture

warcraft-9.0.78\logs\*

[Cheng2Ready]

Thank you @PrewinThomas 

I see yeah I just copied somonelses post for thier input.conf example

https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-with-wildcards/m-p/59916

but my main focus was the Monitor line