Implementing Splunk 7, Third Edition - Third Edition

Selecting files recursively

The layout of your logs or your application may dictate a recursive approach.

For instance, say we have these stanzas:

[monitor:///opt/*/logs/access.log*] 
sourcetype=access 
[monitor:///opt/.../important.log*] 
sourcetype=important 

The character * will match a single file or directory, while ... will match any depth. This will match the files you want, with the caveat that all of /opt will continually be scanned.

Splunk will continually scan all directories from the first wildcard in a monitor path.

If /opt contains many files and directories, which it almost certainly does, Splunk will use an unfortunate amount of resources scanning all directories for matching files, constantly using memory and CPU. I have seen ...