Thanks, that worked. ... View more

Not sure what happened but we upgraded to 4.2.5 and magically started working. Thanks. ... View more

I'm not sure if I have what you're looking for, but here's some more info that might be helpful. First, I don't believe that the crcSalt line is going to help here. My understanding is that that just helps Splunk understand when it might or might not be looking at the same file (or the events in a file) that it's indexed previously. I don't think that has anything to do with adding the file to the list of files to monitor. So what did "splunk list monitor" report? Did it show that at least /log was being monitored but the blahblah*.log file was not being monitored? One important thing to note is that the line [monitor:///log/blahblah_.*\.log] is probably not doing what you think it is. Remember that in this context, there are some regex shortcuts that are being taken. If your file really is named blahblah_0.0.0.653_9110.log then [monitor:///log/blahblah_.*.log] (i.e. no escaped '.' since '.' is the literal period character) should work. Remember that this is creating an implicit whitelist. I'm actually not sure what the '.' would do, but I'd guess that it might actually look for a backslash followed by a dot. I would have thought your whitelist version might have worked assuming you were using a version of newer version of Splunk where "whitelist" replaced the older "_whitelist" keyword. Lowell and gkanapathy were kind enough to write up some nice details to a question I had a while back about the use of wildcards and regexes in inputs.conf at http://splunk-base.splunk.com/answers/2775/regexs-and-windows-paths-in-inputsconf-and-propsconf in case that might also provide some further clues. ... View more