Is it possible to monitor a file in a directory with a wildcard in the path?

[horsefez]

Hello fellow splunkers!

I'm about to set up an universal forwarder monitoring a specific path on a server.
On this server I have some files in the following directory /this/is/an/example/.
The actual files are named like in this example:

AB0101262016
AB0201262016
...
AB1001262016

"AB01" is the name of the instance and will be constant everyday and the rest "01262016" is the date which will of course change everyday.

I thought of an inputs.conf stanza that looks like the following:

[monitor:///this/is/an/example/AB01*.txt]
disabled = false
index = example_application
sourcetype = example_application_admin_log
host = example_application_AB01
crcSalt = <SOURCE>
ignoreOlderThan = 1d

Is the use of the * wildcard legit?
Is this stanza legit?

Any Idea how to make this set up more efficient, because I need to set up 10 individual stanza's now for AB01 - AB10. (it's not that bad, only if you have an idea)

Thanks in advance!

Kind regards,
pyro_wood

[javiergn · Accepted solution]

In principle I don't see anything wrong but I would definitely go through the following doc first:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards

With regards to your second question (AB01 to AB10), if all your files are in the same directory, wouldn't the following work for you?

 [monitor:///this/is/an/example/AB*.txt]

Alternatively you can use regex (see doc above for details), something like maybe:

 [monitor:///this/is/an/example/AB[0-9][0-9]*.txt]

[horsefez]

Hi javiergn,
thank you for your answer. Its very helpful and exactly what I was searching for 🙂

I don't think I'm able to do the second thing like that, because i want to assign the host value with a variable ABxx value everytime.