Combining the comments above: you can use wildcard in your monitor stanza, for example: [monitor:////test/01-1*-2016/test.log] will monitor the directories of October November and December 2016 here is a link to docs: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Specifyinputpathswithwildcards#Input_examples if you have logs from March and April 17 you will probably need 3 stanzas although you can always set one general and then balcklist or send to null queue the data you dont need. blacklist explained here: https://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Whitelistorblacklistspecificincomingdata route and filter data explained here: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad in this case will just do simple 3 stanzas: [monitor:////test/01-1*-2016/test.log] index=test sourcetype = yourSourcetype [monitor:////test/01-01-2017/test.log] index=test sourcetype = yourSourcetype [monitor:////test/01-02-2017/test.log] index=test sourcetype = yourSourcetype ... View more

Hello. Modify your inputs.conf like this [monitor:///var/log/test/*.*] disabled = false sourcetype = test index=tutorial Thanks ... View more