I'm not sure if I understand your example code correctly, but it's quite possible that hashes (#) and square brackets ([,]) can not be part of your fschange stanzas (if that is actually the case). Does your path to the log directories contain these types of character, or are you being informative towards the readers? If the last #1] and #2] in the fschange stanza are treated as comments, then you have unmatching brackets - two starting and one ending.
Somebody more knowledgeable should tell you whether these characters can be present within a stanza or if they must be escaped.
Are there any interesting error messages in splunkd.log when you restart the splunk instance where the fschange monitoring is taking place? That could be a good hint.
A possible workaround, if you cannot rename the directories, is to reference the directories with their short names. Try
dir /x d:\logs\FF-ITP-PRD-01\
which should give the short names (8.3) of the underlying files and directories, in your case something like
ITPDP_~1
ITPDP_~2
Given the length of your real directory name, the short names should hopefully not contain brackets or hashes. At least these were the names given by my win-machine.
BTW, you know you are not supposed to [monitor] and [fschange] the same directory - but this is perhaps what the blacklist is all about.
Hope this helps,
Kristian
... View more