Splunk Search

wildcards and inputs.conf -- directory recursion

Splunk Employee
Splunk Employee

Trying to understand exactly how directory recursion works in inputs.conf.

Specifically, how does /foo/.../.../.log resolve? Does it recurse through the same set of directories as /foo/.../.log ?

Also, can you use "*" in a directory segment to narrow things down a bit? For example: /foo/b*r/.log instead of /foo/.../.log ?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Yes, monitoring...

/foo/.../.../.log

would monitor .log as would the preferred

/foo/.../.log

Additionally, you can use an asterisk within a path as you reference in

/foo/b*r/.log

...to monitor either /foo/bar/.log or /foo/banbar/.log but neither /foo/bar/lorem/.log nor /foo/lorem/bar/.log

The reason is that 3 consecutive dots represent recursing through any number of directories while an asterisk is a wildcard.

View solution in original post

Splunk Employee
Splunk Employee

Yes, monitoring...

/foo/.../.../.log

would monitor .log as would the preferred

/foo/.../.log

Additionally, you can use an asterisk within a path as you reference in

/foo/b*r/.log

...to monitor either /foo/bar/.log or /foo/banbar/.log but neither /foo/bar/lorem/.log nor /foo/lorem/bar/.log

The reason is that 3 consecutive dots represent recursing through any number of directories while an asterisk is a wildcard.

View solution in original post