Splunk Search

Wildcarding help in inputs.conf -- controlling directory depth

Path Finder

Inputs.conf: The stanza [monitor:///app/fao/dittradeflow/servers/.../logs] will look at all folders and subfolders within servers for a dir named logs, how can we modify this so that only the directories within the servers directory are checked for the subfolder logs

We want to monitor for the following:

monitor:///app/fao/dittradeflow/servers/tc3/logs or monitor:///app/fao/dittradeflow/servers/tc2/logs

  But we do not want to monitor:

    monitor:///app/fao/dittradeflow/servers/tc3/stage/logs or monitor:///app/fao/dittradeflow/servers/tc3/stage/CQS
Tags (1)

Splunk Employee
Splunk Employee

You can use a whitelist or blacklist to constrain the input behavior, or use the wildcarding inputs to implicitly create this, eg:


'...' matches any number of directory layers. '*' does not cross directory layers. Thus a matching file would have to contain /app/fao/dittratde/flow/severrs/<somedirectory>/logs This could be something ending in servers/directory/logs-file.log, though. If you want to enforce that 'logs' is a directory and not part of a filename, use:

0 Karma

Splunk Employee
Splunk Employee

The documentation is incorrect. I'm not sure exactly what it was trying to convey, but it will get some edits.

0 Karma


" * matches anything in that specific path segment. It cannot be used inside of a directory path; it must be used in the last segment of the path. For example /foo/*.log matches /foo/bar.log but not /foo/bar.txt or /foo/bar/test.log. "

Looks like the documentation explicitly contradicts your example.

0 Karma


Not sure if you read this post:


but gkanapathy suggested to another splunker to use blacklisting. Sounds like it would work for you and me.


Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...