Recursive monitoring of directories "..." not working in Splunk 6.2

[niklucky02]

I want to monitor /foo/log as well as /foo/bar/log and /foo/var/log. However, I am unable to using this our forwarder currently:

Inputs.conf:

[monitor:///foo/.../log]

[woodcock]

The ... is any number of directories but what I think you need is * which is any single directory. In any case, either should work (but the former might lead to picking up unintended files/directories). Try the asterisk. Also, where did you place your inputs.conf file?

[gcusello]

your command seems to be correct if the log filename to monitor is "log"!
I imagine that you already verified the connection between forwarder and indexer.
bye.
Giuseppe

[niklucky02]

Yes, I have checked inputstatus/TailingProcessor:FileStatus for the forwarder and it says whitelist doesn't match