inputs.conf wildcards and whitelist question

[minthu]

i would like to monitor the following in different sourcetypes, but doesnt seem to get the whitelist correct
there will be other different folders and search just does not go to these other folders
/var/logs/.../mq-e*
/var/logs/.../err-*
/var/logs/.../warn-*
/var/logs/.../*

/var/logs/DNS/SU3000/WDNSAH8700/mq-eWDNSAH8700.log.th
in messagequeue

/var/logs/DNS/SU3000/WDNSAH8700/err-WDNSAH8700.log.th
in errorlog

/var/logs/DNS/SU3000/WDNSAH8700/warn-WDNSAH8700.log.th
in warninglog

/var/logs/DNS/SU3000/WDNSAH8700/WDNSAH8700.log.th
in mainlog

i tried different monitor stanza but nothing gives me the correct logging.

[monitor:///var/logs]
whitelist ="mq-e*.log.*"
sourcetype = messagequeue
index = unix

and tried [monitor:///var/logs/.../mq-s*.log.*] without whitelist, also did not work.

can someone please enlighten me?
appreciate it if anyone could point me to some material to learn about wildcard and whitelist syntaxes as well.

[aholzel]

Not sure if this is the problem but if you have a look at the inputs.conf documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

It says about whitelist:

whitelist = <regular expression>
 * If set, files from this input are monitored only if their path matches the specified regex.
 * Takes precedence over the deprecated _whitelist attribute, which functions the same way.

So it think that the whitelist needs to be something like:

whitelist = .mq-e.*log.

[minthu]

hello,

it works on single sourcetype but when i have multiple sourcetypes it only monitors the first one.


[monitor:///var/logs/]
recursive=true
whitelist =.mq-s.
sourcetype = messagequeue
index = automation
disabled=0
[monitor:///var/logs/]
recursive=true
whitelist =.err.
sourcetype = errlog
index = automation
disabled=0


not sure how we can use different sourcetypes for the same sub folders