Getting Data In

Monitor doesn't work with the path including a space character

hi_sekine
New Member

Is there any workaround ?

I have logs that path beginning with space character. But Splunk doesn't detect them.

Sample files:
Log\20120711\ 0313139\Name54detail.log
Log\20120711\ 1281020\Name55detail.log

inputs.conf:
[monitor://E:\user05...Nam*[Dd]etai*.[Ll][Oo][Gg]]

Tags (1)
0 Karma
1 Solution

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

View solution in original post

0 Karma

hi_sekine
New Member

Thank you for your help, Mr. Takjian.

I'd been confused about "source" display of splunk.
I wondered "source" was less than monitor files.

But the monitor files had duplicated contents. Same lines were recorded on files in different directories.
Then the "source" was less than monitor files.

It seems that there is no lack of file contents.

I'm sorry about my confusion.

0 Karma

Takajian
Builder

I think you can use whitelist. Can you try following configuration?

[monitor:///user05.../]
whitelist = Nam[^/]*.log$

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest – August 2026

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month ...