confused about wildcards in monitor in inputs.conf

[milkovic]

I have directories of logs organized as:

/opt/logjam/logs/nonprod/<service>.<environment>/<logs>

I am attempting to separate out the different environments into separate indexes.

i have the following two monitor stanzas:

# environment: UAT
[monitor:///opt/logjam/logs/nonprod/*uat/]
disabled = false
host_regex = prod/([^\.]*)
index = env_uat
sourcetype = log4j
whitelist = console.*|log$|out$

# environment: QUAL
[monitor:///opt/logjam/logs/nonprod/*qual/]
disabled = false
host_regex = prod/([^\.]*)
index = env_qual
sourcetype = log4j
whitelist = console.*|log$|out$

when I run splunk list monitor, I see:

Monitored Directories:
/opt/logjam/logs/nonprod/*uat/
    /opt/logjam/logs/nonprod/advisorportal01.devl
    /opt/logjam/logs/nonprod/advisorportal01.qual
    /opt/logjam/logs/nonprod/advisorportal01.test
    /opt/logjam/logs/nonprod/advisorportal01.uat
    /opt/logjam/logs/nonprod/advisorportal01.uat/catalina.2012-05-15.log
    /opt/logjam/logs/nonprod/advisorportal01.uat/catalina.2012-05-30.log
….

Monitored Files:
$SPLUNK_HOME/etc/splunk.version
/opt/logjam/logs/nonprod/*devl/
/opt/logjam/logs/nonprod/*qual/
/opt/logjam/logs/nonprod/*test/
/opt/logjam/logs/prod/*mirr/

which suggests that all of the files under /opt/logjam/logs/nonprod are getting lumped into the same index. Any help is appreciated.

[milkovic]

I did a splunk clean eventdata and restarted. Although splunk list monitor still shows the files as associated with the first wildcard, it appears that the right thing is happening at the indexer. Doing some basic searches shows the correct files are ending up in the correct indexes, and there does not appear to be any pollution across the indexes.