Splunk documentation is incorrect, as it states you should be able to do something like this :
and it should pick up al these:
so my question is, how do we do this?
Did you try explicitly setting recursive = true?
recursive = true