Splunk Search

wildcard monitoring

a212830
Champion

Hi,

I'm doing some testing in my lab, and want to monitor all files in a directory that don't have .csv. I have the following in my inputs.conf

[monitor:///usr/local/nsmutils/export/current/]
index=perfstats
sourcetype=snmpinfo
followTail = 0
blacklist = .csv

However, nothing is getting indexed. Files are there and readable. I did a "oneshot" and the data looks good, but now I want to add it properly. Am I missing something? Somewhat related... I am also using this as an indexer. Do I need an outputs.conf in this situation, since the data is being indexed here? Could that be the problem?

Tags (1)
0 Karma

Dimitri_McKay
Splunk Employee
Splunk Employee

So you are looking at a folder and in it you have mixed software types. Is there a reason you aren't just naming out the types you have instead? Or are you just testing the blacklist functionality?

0 Karma

a212830
Champion

It's easier to do the blacklist - too many files to do a whitelist.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...