@alberttra This question is almost 7 years old so you're unlikely to get many responses. You should post a new question. ... View more

This returned all the results I was looking for. Thanks! ... View more

Nelsonbarringer, The regexes on the monitor header may not do what you want to do. The asterisk (*) matches anything in a single path segment while "..." will recurse through directories. I think you'd be better off using whitelist and blacklist under your monitor stanzas. Check here for more info on white/blacklisting: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more