I'm using Splunk 6.1.3 for Windows and have an issue with indexing files that reside in a folder that contains periods in the folder name.
An example is
I have attempted a few different syntax formats listed below and will not index the files. Any suggestions as to how I can identify why it's not indexing these APP*.log files?
[monitor://D:\Application\Logs\...\APP*.log] crcSalt = ignoreOlderThan = 2d index = indexname sourcetype = sourcetypename recursive=false disabled=false [monitor://D:\Application\Logs\X.Y.Z\APP*.log] crcSalt = ignoreOlderThan = 2d index = indexname sourcetype = sourcetypename recursive=false disabled=false
Thanks for any assistance.
Why the extra slash at
should do it...
Yeah.. I just tried that not too long ago and the wildcard doesn't pickup either.. the extra "\" was due to the way the edit rendered and didn't display in the preview correctly.. I've edited the post.
If I explicitly added the full name, it works -- I was looking to avoid having to create 32 stanzas.. I presume it's a limitation of the matching logic or something.
i'll just go down the creation route.. thanks.
It doesn't make any sense. A limitation - maybe a bug ; -) smells like a bug for sure...