Getting Data In

Multiple Wildcards in inputs.conf

Path Finder


Can I use the following expression in my inputs.conf




Tags (1)

Splunk Employee
Splunk Employee

The simple wild cards for path are : * and ..., they are automatically replaced by regexes

It is not recommended to use regexes in the path (need to start to escape any special characters, by example file.txt has to be file\.txt ), instead you can use whitelist and blacklists that can contain regexes.

so with your case,
has to be something like

whitelist = .*MS?\.log\.gz

while the second should work because it uses only wildcards.


Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...