Getting Data In

Multiple Wildcards in inputs.conf

Path Finder


Can I use the following expression in my inputs.conf




Tags (1)

Splunk Employee
Splunk Employee

The simple wild cards for path are : * and ..., they are automatically replaced by regexes

It is not recommended to use regexes in the path (need to start to escape any special characters, by example file.txt has to be file\.txt ), instead you can use whitelist and blacklists that can contain regexes.

so with your case,
has to be something like

whitelist = .*MS?\.log\.gz

while the second should work because it uses only wildcards.


Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...