I want to write a monitor stanza that picks up a log named "mytest.log" which may be found in either /var/log/app/ or /var/log/app/testlogs/ according to this: http://docs.splunk.com/Documentation/Splunk/4.2.4/Data/Specifyinputpathswithwildcards, it seems possible to do what i want by defining [monitor:///var/log/app/*/mytest.log specifically described in this section of the table describing use of "": /foo//bar matches the files /foo/bar, /foo/1/bar, /foo/2/bar, etc. My monitor stanza is: [monitor:///var/log/app/*/mytest.log] index = lab sourcetype = log4j blacklist = .(gz|bz2|z|zip)$ i expected splunk to pick up both /var/log/app/mytest.log and /var/log/app/testlogs/mytest.log, but instead only the latter is actually picked up. it seems that the base dir of /var/log/app/ is not being searched ... View more

I'm having trouble crafting a regex that would pull key=value pairs where the pairs are separated by a character sequence, "+++" for example. I'd like to use a sequence because its way less likely to show up in my log events than a single character delimiter. Each log event is single line. here is a sample: ts=2011-11-16T21:41:21Z+++aid=1167949209+++ip=1.1.1.2+++g=ir4205+++id=http://xyz.com/not/Import/10+++t="The Best ++Pt. 1 Book:Roland"+++sz=13880020+++pl=X_YZ+++pc=1+++pvid=1001+++rg=jfkdjd+++pid=asdf_1234+++rs=720+++rt=2 i've been testing with a transforms.conf entry like: REGEX = (\w+)=([^\+]+(?!\+{3})) FORMAT = $1::$2 but this regex leaves off the last character of every value I am essentially trying to get around the same issue listed here- which is I started with DELIMS but I can't guarantee that my delimiter won't appear in my log entry and there doesn't appear to be a way to escape the delimiter. http://splunk-base.splunk.com/answers/3231/escaping-characters-in-an-event ... View more