Why is my inputs.conf monitor stanza with multiple wildcards not picking up anything?

[smdasim]

Hi Team,
I want to read below log files in 3 separate source types like deprovision , preprovision and provision but the code mentioned in picking one source type files.

2072.37915_xxalslnxxxt10029_deprovision_runlist.log
2072.37915_xxalslnxxxt10029_provision_runlist.log
2072.37915_xxalslnxxxt10029_preprovision_runlist.log

inputs.conf code :

[monitor://C:\opt\hyperblue\logs\build_logs*_preprovision_runlist.log]
[monitor://C:\opt\hyperblue\logs\build_logs*_provision_runlist.log]
[monitor://C:\opt\hyperblue\logs\build_logs*_deprovision_runlist.log]

Please hekp

Regards
smdasim

[smdasim]

Current Code which is only picking all logs and putting into sourcetype server_deprovision:default

[monitor://C:\opt\hyperblue\logs\build_logs*_provision_runlist.log]
disabled = false
sourcetype = server_provision:default
blacklist= _deprovision_runlist|_preprovision_runlist.log$

[monitor://C:\opt\hyperblue\logs\build_logs*_preprovision_runlist.log]
disabled = false
sourcetype = server_preprovision:default
blacklist= _provision_runlist|_deprovision_runlist.log$

[monitor://C:\opt\hyperblue\logs\build_logs*_deprovision_runlist.log]
disabled = false
sourcetype = server_deprovision:default
blacklist= _provision_runlist|_preprovision_runlist.log$

[adonio]

kindly read here for full description:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Specifyinputpathswithwildcards
or use @DalJeanis answer below

[smdasim]

[monitor://C:\opt\hyperblue\logs\build_logs**_preprovision_runlist.log]

or
[monitor://C:\opt\hyperblue\logs\build_logs***_preprovision_runlist.log]

not working

[DalJeanis]

An asterisk matches any set of characters in a single path segment. You can use ** to represent any number of levels of path.

Seems like you probably want

[monitor://C:\opt\hyperblue\logs\build_logs*\*_preprovision_runlist.log]

or

[monitor://C:\opt\hyperblue\logs\build_logs**\*_preprovision_runlist.log]

[smdasim]

Using above solution is resulting the sourcetype to set to breakable_text

[adonio]

not quite sure as it seems unclear to me what 2072.37915_xxalslnxxxt10029_deprovision_runlist.log portion of the string / location means
your inputs.conf has to specify exactly where the file resides and use wild cards where they can be applied
example:
C:\hello\here\is\my\data.log
C:\hello\here\is\my\other_data.log
this stanza will capture the top one only:
[monitor://C:\hello\here\is\my\data.log]
this will capture both:
[monitor://C:\hello\here\is\my\*data.log]
or
[monitor://C:\hello\here\is\my\]
hope it helps