Getting Data In

inputs.conf wildcards don't work

Path Finder

=== Splunk 5.0.2 ===

I'd like to monitor these files, where "manydirs" is a wildcard:

/my/path/manydirs/error/*.log

so, my monitor stanza looks like this:

[monitor:///my/path/*/error/]
disabled = false
index = myindex
sourcetype = myerrors
recursive = false

also tried this:

[monitor:///my/path/*/error/*.txt]

splunk list monitor shows the correct path.
and no TailingProcessor errors
Yet nothing got indexed.
The doc sounds pretty straight forward but didn't work.
Very frustrated. Please help.

Thanks, Tony.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

You need to use ... to recurse multiple levels of directories.

[monitor:///my/path/.../error/*.log]
disabled = false
index = myindex
sourcetype = myerrors

View solution in original post

Path Finder

Gotta clarify my problem.
I don't want recursive, but rather many different directories at the same level where '' is,

i.e

/my/path/core/error/
.log

/my/path/supp/error/.log

/my/path/misc/error/
.log

...

I guess i could use the recursive '...' route, but even that didn't work for me.

0 Karma

Motivator

why did you make it your accepted answer then?

0 Karma

Splunk Employee
Splunk Employee

You need to use ... to recurse multiple levels of directories.

[monitor:///my/path/.../error/*.log]
disabled = false
index = myindex
sourcetype = myerrors

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!