Getting Data In

Multiple wildcards for file path in inputs.conf

budimaos
Engager

I need to monitor a file under multiple similar paths, the full path can be dynamic so putting absolute path is not an option.

Actual path example: E:\OpenPages\profiles\OpenPagesNode1\logs\OpenPagesNodeServer2Server3\http_error.log

So I have the following monitor stanza and it doesn't pick up the files. Nothing useful in _internal log which indicate any problem.

[monitor://E:\OpenPages\profiles\OpenPagesNode*\logs\OpenPagesNodeServer*\http_error.log]

I suspect it's due to multiple wildcards on the path, since other file with similar stanza picked up just fine, as below,

[monitor://E:\OpenPages\profiles\OpenPagesNode*\logs\ffdc\(nodeagent|OpenPagesNode)*.log]

I can't really play around with it at the moment, but I'm pretty sure it'll work if I use the following monitor stanza instead,

[monitor://E:\OpenPages\profiles\...\http_error.log]

But I want to avoid it if possible since it will force the forwarder to traverse through all irrelevant subdirectories.

Any good suggestion?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...