inputs.conf is there a difference

[gerdhuber]

Hallo,

i only want to monitor files in the directory pkorb and not files in subdirectory pkorb/oldlogs
What is the right monitor ?

1. [monitor:///var/log/pkorb]
2. [monitor:///var/log/pkorb/]

or any other ?

[skoelpin · Accepted solution]

[monitor:///var/log/pkorb/*] will forward any files sitting in the pkorb directory but will NOT forward files from sub-directories in that pkorb directory

If you wanted to ingest data from a subdirectory, it would look like

[monitor:///var/log/pkorb/.../*]

[gerdhuber]

thank you

[skoelpin]

Did this answer your question? If so then please accept the answer

[gerdhuber]

yes, this is what i am looking for.

[skoelpin]

Can you please accept the answer and close it out?

[martin_mueller]

I'd give this a shot:

[monitor:///var/log/pkorb]
recursive = false

Alternatively, this:

[monitor:///var/log/pkorb]
blacklist = oldlogs

The latter would recurse, but skip the oldlogs directory. See http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/inputsconf for specs.