Hello all,
my direcotry structur :
/data/A/logs/aaaaaaa.log
/data/A/logs/aaaaaaa1.log
/data/B/logs/aaaaaaa.log
/data/B/logs/aaaaaaa1.log
my inputs.conf
[monitor:///data/*/logs]
sourcetype=mysourcetype
index=idx_myindex_dev
disabled=false
A) If I'am putting the Fullpath "for example /data/A/logs/" to the monitor field it works fine
B) If I try it with the inputs.conf above, he lists me only the directorys, but doesn't index any file. In the Splunkd.log he says Parsing configuration stanza: monitor:///data/*/logs. No error, no information.
According to the Documentation :
`The asterisk () matches anything in a single path segment;
unlike "...", it does not recurse. For example,
/foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar,
etc. However, it does not match /foo/1/2/bar.
wich is fine for me, anyway I tried it also with the ... witch would be also fine for me but that doesn't work either.
Q : Any Idea what I'am doing wrong ?
Universalforwarder : 4.2.3
OS : AIX 6.1
Documentation : http://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf
