I searched on answers but I can't seem to come up with a clear answer. Has anyone figured out a workaround for the "Warning: In Windows, you cannot currently use a wildcard at the root level. For example, this does not work:[monitor://E:\...\foo\*.log]" from http://docs.splunk.com/Documentation/Splunk/latest/data/Specifyinputpathswithwildcards
I am attempting to forward log files using wildcards in my monitor names. I am using Splunk version 4.3.2. Thank you for your help.
Well, I would guess that you could use
But there are probably other work-arounds as well. What directories do you want to monitor? Can you give us more details on what you are trying to do?
Thank you all for your help. I accomplished this by pointing to the specific folder explicitly and then using whitelists to get the necessary logs out.@lguinn, thank you. @jkat54 Thank you, I also try this and see if it works.