Our logfiles are named in the format Log.Activity.prod.###.txt where ### is random number. Also we want to leave out previous days log which would be in the format Log.Activity.prod.###.yyyy-mm-dd.txt (using the blacklist -). We have setup splunk light forwarders and following is what we have on our Inputs.conf file: [monitor://d:\LogFiles\prod\Log.Activity.prod.*] blacklist = - disabled = false sourcetype = Prod [monitor://d:\LogFiles\beta\Log.Activity.beta.*] blacklist = - disabled = false sourcetype = Beta [monitor://d:\LogFiles\alpha\Log.Activity.alpha.*] blacklist = - disabled = false sourcetype = Alpha But for some reason splunk does not identify the file that is being logged to. ... View more

We need to index a file which has the day's date as part of its name. How to I configure Splunk to read this file? Indexing the folder is an option, but I want to eliminate this option before taking the other route. ... View more