I am in the process of implementing Splunk in a fairly long-lived environment. Log directories contain date-masked log files. I would like to ignore files before today's date, and only import new files. Example: /opt/someApplication/logs/someApplication.202412160600.out I am unable to wildcard /opt/someApplication/logs/someApplication.*.out as there are logs dating back to 2017 and I'd exceed our daily license/quota by several orders of magnitude. Changing the logging format is not an option. Exclude-lists appear to be a solution, but even using regex would be incredibly burdensome. Thoughts?
... View more