Multiple Wildcards in inputs.conf

[mkelderm]

Hi,

Can I use the following expression in my inputs.conf

/data/logs/kim/.../**MS?.log.gz*

Or

/data/logs/kim/.../*stderr*

[yannK]

The simple wild cards for path are : * and ..., they are automatically replaced by regexes
see http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/Specifyinputpathswithwildcards

It is not recommended to use regexes in the path (need to start to escape any special characters, by example file.txt has to be file\.txt ), instead you can use whitelist and blacklists that can contain regexes.

so with your case,
[monitor:///data/logs/kim/.../*MS?.log.gz]
has to be something like

[monitor:///data/logs/kim/...]

whitelist = .*MS?\.log\.gz

while the second should work because it uses only wildcards.

[monitor:///data/logs/kim/.../stderr]