Is it possible to monitor and index files in a folder that has multiple periods in the name?

[Michael_Ekkert]

Hi,

I'm using Splunk 6.1.3 for Windows and have an issue with indexing files that reside in a folder that contains periods in the folder name.

An example is D:\Application\Logs\Z.Y.Z\APP01_13776_20161019.log

I have attempted a few different syntax formats listed below and will not index the files. Any suggestions as to how I can identify why it's not indexing these APP*.log files?

[monitor://D:\Application\Logs\...\APP*.log]
crcSalt = 
ignoreOlderThan = 2d
index = indexname
sourcetype = sourcetypename
recursive=false
disabled=false

[monitor://D:\Application\Logs\X.Y.Z\APP*.log]
crcSalt = 
ignoreOlderThan = 2d
index = indexname
sourcetype = sourcetypename
recursive=false
disabled=false

Thanks for any assistance.

[ddrillic]

Why the extra slash at

[monitor://D:\Application\Logs\\...\APP*.log]

[monitor://D:\Application\Logs\...\APP*.log]

should do it...

What about?

[monitor://D:\Application\Logs\*\APP*.log]

[Michael_Ekkert]

Yeah.. I just tried that not too long ago and the wildcard doesn't pickup either.. the extra "\" was due to the way the edit rendered and didn't display in the preview correctly.. I've edited the post.

[ddrillic]

And if you put the Z.Y.Z in the monitor, does it work?

[Michael_Ekkert]

If I explicitly added the full name, it works -- I was looking to avoid having to create 32 stanzas.. I presume it's a limitation of the matching logic or something.

i'll just go down the creation route.. thanks.

[ddrillic]

It doesn't make any sense. A limitation - maybe a bug ; -) smells like a bug for sure...