I have some input stanzas that look like this:
[monitor:///opt/app/master_proc*/logs/*]
[monitor:///opt/app/backup_proc*/logs/*]
[monitor:///opt/app/simulator*/logs/*]
All three of those inputs are going to a "qa" index. There are log files in other directories in the same location which I want to send to a "development" index.
I was reading http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories and saw a paragraph that said,
> "Monitor inputs may overlap. So long as the stanza names are different, Splunk Enterprise treats them as independent stanzas and files matching the most specific stanza will be treated in accordance with its settings."
Does that mean I can add a stanza after the ones above that looks like this:
[monitor:///opt/app/*/logs/*]
And it will match any files that do not match the ones above? My understanding from the documentation is that it will since it's less specific than the other three.
