I found a solution, from a very awesome Splunker (Sanford, FTW!!). A better recipe is to use the whitelist for regex and leave wildcards out of the monitor path altogether. Remember that wildcards (*) are generally greedy, and using regex is much more surgical and generally much faster for processing.
Example - pick up CPlogs in c:\OnState\Instances\kfeagans01\ConsoleCP\CPlog01.txt
[monitor://C:\OnState\Instances\]
whitelist = k[A-z]+\d{1,2}\\ConsoleCP\\CPlog\d{0,3}\.txt
sourcetype=test
index=test
So, basically whitelist the subdirectory tree that includes your wildcards, in this case using regex instead. Works awesome. As a matter of fact, I was able to expand this to include other trees as well to pick up more data from the subdirs underneath each userid:
Example - pick up logfiles in the following directories:
C:\OnState\Instances\kfeagans01\ConsoleCP\CPlog01.txt (etc)
C:\OnState\Instances\kfeagans01\RemoteDB\DBlog01.txt (etc)
C:\OnState\Instances\kfeagans01\Accumulator\log01.txt (etc)
C:\OnState\Instances\kfeagans01\RTAClient\log01.txt (etc)
[monitor://C:\OnStat\Instances\]
whitelist = k[A-z]+\d{1,2}\(ConsoleCP|RemoteDB|Accumulator|RTAClient)\(CPlog|DBlog|log)\d{0,3}\.txt
sourcetype=test
index=test
You can even follow that up with a props/transforms to change the sourcetype from test to match the source; IE, create sourcetypes ConsoleCP, RemoteDB, Accumulator, RTAClient.
--
Kelly
