Getting Data In

Multiple Wildcards in inputs.conf

mkelderm
Path Finder

Hi,

Can I use the following expression in my inputs.conf

/data/logs/kim/.../**MS?.log.gz*

Or

/data/logs/kim/.../*stderr*

Tags (1)

yannK
Splunk Employee
Splunk Employee

The simple wild cards for path are : * and ..., they are automatically replaced by regexes
see http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/Specifyinputpathswithwildcards

It is not recommended to use regexes in the path (need to start to escape any special characters, by example file.txt has to be file\.txt ), instead you can use whitelist and blacklists that can contain regexes.

so with your case,
[monitor:///data/logs/kim/.../*MS?.log.gz]
has to be something like


[monitor:///data/logs/kim/...]
whitelist = .*MS?\.log\.gz

while the second should work because it uses only wildcards.


[monitor:///data/logs/kim/.../stderr]

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...