Getting Data In

Wildcard ... not working in my stanza

daymar_23
Explorer

Hello All: 

I have problems with my application where I am configuring the following stanza in the inputs.config file (C:\Program Files\SplunkUniversalForwarder\etc\apps\ope_web_api\default): 

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Specifyinputpathswithwildcards

  • [monitor://D:\package\...\version\Admin\APIS\log]
    disabled = 0
    index = ope_web_api
    sourcetype = api_logs
    ignoreOlderThan = 1d

I have Splunk Cloud 8.2.2 version. 

If I change the ... by the name of the file it works fine: 

  • [monitor://D:\package\ABC\version\Admin\APIS\log]
    disabled = 0
    index = ope_web_api
    sourcetype = api_logs
    ignoreOlderThan = 1d

But I need the ... because not always is the same file name. 

Does somebody know what I am missing here? 

Regards. 

 

Labels (2)
0 Karma

Azeemering
Builder

Have you tried [monitor://D:\package\*\version\Admin\APIS\log]

Example from the docs Specify input paths with wildcards - Splunk Documentation

To monitor /apache/foo/logs, /apache/bar/logs, but not /apache/bar/1/logs or /apache/bar/2/logs, create the following stanza:

[monitor:///apache/*/logs]
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...