Splunk Search

inputs.conf wildcards and whitelist question

New Member

i would like to monitor the following in different sourcetypes, but doesnt seem to get the whitelist correct
there will be other different folders and search just does not go to these other folders

in messagequeue

in errorlog

in warninglog

in mainlog

i tried different monitor stanza but nothing gives me the correct logging.

whitelist ="mq-e*.log.*"
sourcetype = messagequeue
index = unix

and tried [monitor:///var/logs/.../mq-s*.log.*] without whitelist, also did not work.

can someone please enlighten me?
appreciate it if anyone could point me to some material to learn about wildcard and whitelist syntaxes as well.

Tags (2)
0 Karma


Not sure if this is the problem but if you have a look at the inputs.conf documentation:

It says about whitelist:

whitelist = <regular expression>
 * If set, files from this input are monitored only if their path matches the specified regex.
 * Takes precedence over the deprecated _whitelist attribute, which functions the same way.

So it think that the whitelist needs to be something like:

whitelist = .mq-e.*log.

0 Karma

New Member


it works on single sourcetype but when i have multiple sourcetypes it only monitors the first one.

whitelist =.mq-s.
sourcetype = messagequeue
index = automation
whitelist =.err.
sourcetype = errlog
index = automation

not sure how we can use different sourcetypes for the same sub folders

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...