I'm running splunk forwarder 6.4.1 on Ubuntu 14.04. I'm attempting to use splunk to monitor Jenkins build logs, which have a path like /var/lib/jenkins/jobs/*/builds/*/log , e.g. /var/lib/jenkins/jobs/ajobname/builds/1234/log , where log is a text file. My inputs.conf looks like this: [monitor:///var/lib/jenkins/jobs/*/builds/*/log] blacklist = \.(gz)$ recursive = False sourcetype = jenkins index = tools-jenkins followSymlink = false [monitor:///var/log] blacklist = \.(gz)$ recursive = True sourcetype = syslog index = tools Searching on the splunk server, I can see that logs from the second monitor stanza are getting indexed, while logs from the first stanza are not. I checked the logs, and I see two relevant messages in splunkd.log: 06-27-2016 19:27:34.490 +0000 INFO TailingProcessor - Parsing configuration stanza: monitor:///var/lib/jenkins/jobs/*/builds/*/log. 06-27-2016 19:27:34.491 +0000 INFO TailingProcessor - Adding watch on path: /var/lib/jenkins/jobs. I tried setting the monitor path on the first stanza to point to a specific file, which works as expected, which rules out potential permissions issues. I also tried using splunk list monitor to see the list of monitored files, but for some reason I'm unable to auth to use the CLI. My best guess is that the first monitor stanza isn't matching the desired files. Why won't splunk monitor the jenkins logs? ... View more