Getting Data In

Monitor doesn't work with the path including a space character

hi_sekine
New Member

Is there any workaround ?

I have logs that path beginning with space character. But Splunk doesn't detect them.

Sample files:
Log\20120711\ 0313139\Name54detail.log
Log\20120711\ 1281020\Name55detail.log

inputs.conf:
[monitor://E:\user05...Nam*[Dd]etai*.[Ll][Oo][Gg]]

Tags (1)
0 Karma
1 Solution

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

View solution in original post

0 Karma

hi_sekine
New Member

Thank you for your help, Mr. Takjian.

I'd been confused about "source" display of splunk.
I wondered "source" was less than monitor files.

But the monitor files had duplicated contents. Same lines were recorded on files in different directories.
Then the "source" was less than monitor files.

It seems that there is no lack of file contents.

I'm sorry about my confusion.

0 Karma

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...