Getting Data In

Multiple Wildcards in inputs.conf

Path Finder


Can I use the following expression in my inputs.conf




Tags (1)

Splunk Employee
Splunk Employee

The simple wild cards for path are : * and ..., they are automatically replaced by regexes

It is not recommended to use regexes in the path (need to start to escape any special characters, by example file.txt has to be file\.txt ), instead you can use whitelist and blacklists that can contain regexes.

so with your case,
has to be something like

whitelist = .*MS?\.log\.gz

while the second should work because it uses only wildcards.


Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...