multiple monitor for same directory

[attgjh1]

I am attempting to read different types of log into various sources. But all the logs belong in the same directory and i cannot have multiple monitors in them

the various logs are located at desktop\test\

1. pulsar_handler_machineid.2012-05-28-(hour)
2. inbound_handler_machineid.2012-05-28-(hour)
3. outbound_handler... etc

My initial attempt involved only using websplunk but i realised we cannot have more than one monitor on the same directory.

i tried with inputs.conf

[monitor://C:\Documents and Settings\attgjh1\Desktop\test\pulsar*]

disabled = false

followTail = 0

sourcetype = pulsar

the same settings were also created for the other logs.
however, splunk did not index any of the logs at all. (even after restarting)

im fairly new to using props.conf and inputs.conf to do stuffs.
can someone help me? thanks!

[sdaniels · Accepted solution]

The monitor stanzas will be in inputs.conf and you can edit the file directly rather than use the UI but that should work as well. You could just use the following and splunk will monitor all files in that directory.

[monitor://C:Documents and Settings\attgjh1\Desktop\test]

You can also use wildcards
http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards

If there are files you don't want you can use a blacklist like this.

/#i want to ignore zipped files
blacklist = .(gz|bz2|z|zip)$