You're seeing log/*/*/*.log because Splunk interprets the wildcard "greedily", i.e. it will match as much as possible. There is no way that I know of to make the wildcards non-greedy, but there are workarounds that you can use. One is to specify explicitly that you want sources that match /logs/*/*.log but not /logs/*/*/*.log : source="/logs/*/*.log" AND NOT source="/logs/*/*/*.log" Or you could use regex to filter results, like below. source="/logs/*/*.log" | regex source="/logs/[^/]+/[^.]+\.log" ... View more