Warning massage at splunkforwarder startup

[RobertRi]

Hi

I have installed a 5.0.1 windows universal forwarder, and if i restart the uniforw. I get this message

Checking conf files for typos...                
Possible typo in stanza [monitor:C:\Program Files\Application Prod\logs] in C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 6: blacklist  =  \.zip$
There might be typos in your conf files. For more information, run 'splunk btool check --debug'

If I run a splunk list monitor, then all zip files are excluded from monitoring and it works as desired

This is the inputs.conf

[default]
host = server1

[monitor:C:\Program Files\Application Prod\logs]
disabled = false
blacklist = \.zip$
index = application

Is there anything wrong in this stanza config?

Thanks
Rob

[kristian_kolb · Accepted solution]

It should say [monitor://c:\Program......etc.], i.e. you're missing the two slashes after monitor:

That's the only type I see.

/Kristian

[RobertRi]

Thanks, that was it