star wildcard in monitor stanza does not look at root directory

[tpsplunk]

I want to write a monitor stanza that picks up a log named "mytest.log" which may be found in either /var/log/app/ or /var/log/app/testlogs/

according to this: http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Specifyinputpathswithwildcards, it seems possible to do what i want by defining [monitor:///var/log/app/*/mytest.log

specifically described in this section of the table describing use of "": /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc.

My monitor stanza is:
[monitor:///var/log/app/*/mytest.log]
index = lab
sourcetype = log4j
blacklist = .(gz|bz2|z|zip)$

i expected splunk to pick up both /var/log/app/mytest.log and /var/log/app/testlogs/mytest.log, but instead only the latter is actually picked up. it seems that the base dir of /var/log/app/ is not being searched

[hexx · Accepted solution]

The important part in the documentation topic you are referencing is this one :

Wildcard : *
Description : The asterisk wildcard matches anything in that specific directory path segment. Unlike "...", "*" doesn't recurse through any subdirectories.
Regex equivalent : [^/]*

This means that your stanza definition of [monitor:///var/log/app/*/mytest.log] translates into the following regular expression :

/var/log/app/[^/]*/mytest.log

This will not match the following path :

/var/log/app/mytest.log

What you need is for your stanza definition to be [monitor:///var/log/app/...mytest.log].

[tpsplunk]

"The asterisk () matches anything in a single path segment; unlike "...", it does not recurse.

For example, /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc.
However, it does not match /foo/1/2/bar . "

it's the piece that says "/foo//bar matches the files /foo/bar " that i think is wrong. it's what led me to believe that /var/log/app//mytest.log would match /var/log/app/mytest.log

[hexx]

How so? Please quote the page/block of text that makes you say so, I'd be happy to fix it.

[tpsplunk]

i'll try this out. it makes sense, but it means the documentation inside inputs.conf is wrong