Getting Data In

Multiple Wildcards in inputs.conf

Path Finder


Can I use the following expression in my inputs.conf




Tags (1)

Splunk Employee
Splunk Employee

The simple wild cards for path are : * and ..., they are automatically replaced by regexes

It is not recommended to use regexes in the path (need to start to escape any special characters, by example file.txt has to be file\.txt ), instead you can use whitelist and blacklists that can contain regexes.

so with your case,
has to be something like

whitelist = .*MS?\.log\.gz

while the second should work because it uses only wildcards.


Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...