Getting Data In

Input stanza path is not absolute.

archspangler
Path Finder

How do I wildcard any windows drive letter in the inputs.conf stanza below?

inputs.conf

[monitor://[A-Z]:\Data\Disk1\*\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog

Causes the below error...

07-16-2015 10:53:57.601 -0400 WARN  TailingProcessor - Input stanza path, '[A-Z]:\\Data\\Disk1\\*\\MSSQL\\Log\\ERRORLOG*' is not absolute.  This is a configuration error and may not work / break things.  Change this path to an absolute path.
Tags (2)
0 Karma

emiller42
Motivator

So this gets into how Splunk actually identifies what it needs to monitor. Take a more traditional monitor stanza like:

[monitor://C:\Data\Disk1\*\MSSQL\Log\ERRORLOG*]

When splunk sees the above, it goes to the deepest full path given C:\Data\Disk1\ and turns the rest of the stanza name into a regex-based whitelist which is checked against all children of the given path.

When your monitor stanza starts with a wildcard, it has no base path to enumerate in the first place. (Windows doesn't have an equivalent to /) Even if it did, this is a bad idea as Splunk will need to enumerate every single file on a system to see if it is a regex match of the desired path.

martin_mueller
SplunkTrust
SplunkTrust

To add an actual solution, just put up to 26 stanzas in your inputs.conf.

emiller42
Motivator

Yes, apologies I thought this was implied in my answer.

martin_mueller
SplunkTrust
SplunkTrust

It was, no worries.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...