@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.
Example:
#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored. So splunk list monitor would not list them if they where not already indexed.
[monitor:\$SPLUNK_HOME\var\log\splunk]
ignoreOlderThan=2d
blacklist=metric
@lqiao, Well that depends on how that monitor was configured. That command will only files in that directory found or meet the whitelist or blacklist settings under that montior stanza.
Example:
#the following two settings will prevent any thing with metric in the path from being or older than 2days monitored. So splunk list monitor would not list them if they where not already indexed.
[monitor:\$SPLUNK_HOME\var\log\splunk]
ignoreOlderThan=2d
blacklist=metric