Should I use an ellipsis or * in my inputs.conf monitor stanza?

[mcbradford]

I have an IIS server and the path to the files I want to monitor looks like this:

d:/web/logfiles/W3SVC1
d:/web/logfiles/W3SVC11516
d:/web/logfiles/W3SVC155546
d:/web/logfiles/W3SVC122551

Within each of the W3SV path, there are .log files

correct syntax below, "/" were removed

should my monitor stanza look like this?

[monitor://d:\Shrine\logfiles\...\*log]

OR

[monitor://d:\Shrine\logfiles\*\*log]

I would prefer to use the second, because the ellipse (...) can use up CPU.

[dschmidt_cfi]

I will preface this with I am brand new to Splunk; however, the way I was shown to construct my inputs.conf file (*nix) is like;

[monitor:///var/log/syslog/ise/.../ise.log]
sourcetype = syslog
index = network
host_segment = 5

using both the ellipsis as well as the host_segment statement marking that as the host. I use the '*' in shell scripting but have not tried it under Splunk. My host segment contains the hostname of the server plus month and day so my directory would look like;

/var/log/syslog/ise/rft-isep01/02/10/ise.log for the server rft-isep01 for the 10th of Feb. This allows some flexibility for backups and such.

Nevertheless, you could compare the transfer rates from two chatty streams if you are concerned about cpu or network usage. Try one of each on two different but equally taxed IIS servers.

Personally, until my systems are that taxed that every CPU cycle is required to be planned for--I plan on doing it the way I was taught.

[eckdale]

As it turns out I enabled monitoring of IIS logs about 10 minutes ago on a test server, using the ellipsis, which was based on reading the following Splunk documentation: Specify input paths with wildcards.

The path to my IIS logs is very similar:

H:/inetpub/logs/Logfiles/%sitename%/W3SVC%ID%/

So the stanza in my inputs.conf looks like:

# IIS Monitoring --------------------------------------------------------------
[monitor://H:\inetpub\logs\LogFiles\...\*.log]
disabled = false
sourcetype = iis
index = iis-logs

While this works I guess it doesn't directly answer you question so maybe not so helpful?