I have the following folder listing in C:\Resources\Directory\ which the naming of the folder are dynamic. It changes dynamically when logs are created with this type of prefix (dynamic).(dynamic).(Fixed)
Example :
(dynamic) . (dynamic) . (Fixed)
0068f67b289b43dfb5302cb26cb9e536.KeyValidationWebRole.DiagnosticStore
0068f67b289b43dfb5302cb26cb9e536.KeyValidationWebRole.localInstallDirectory
0068f67b289b43dfb5302cb26cb9e536.KeyValidationWebRole.LogStorage
Questions :
[monitor://C:\Resources\Directory\*.*.DiagnosticStore] disabled = false followTail = 0 sourcetype = mysourcetype
Looking at the online docs I see the following:
Note concerning wildcards and monitor:
Are there files under the DiagnosticStore directory?
[monitor://C:\Resources\Directory...DiagnosticStore...]
Does this work.
Here is the link to more info in the Docs:
http://docs.splunk.com/Documentation/Splunk/4.2.4/admin/Inputsconf
On the first question, I would use the "..." syntax in your monitor stanza. For instance:
[monitor://C:\Resources\Directory...DiagnosticStore]
On the second question you can use the "..." syntax as well in the prop.conf to pull out only certain files and give them specific encoding. For instance:
[source::...KeyValidationWebRole.DiagnosticStore...]
sourcetype=awesome
Might help to see what the file names under this directory.
Tried your solution and it does not work
Not working
[monitor://C:\Resources\Directory\ ..DiagnosticStore]
[monitor://C:\Resources\Directory\...DiagnosticStore]
[monitor://C:\Resources\Directory\*DiagnosticStore]
Any suggestions ??