Is there any workaround ?
I have logs that path beginning with space character. But Splunk doesn't detect them.
Sample files:
Log\20120711\ 0313139\Name54detail.log
Log\20120711\ 1281020\Name55detail.log
inputs.conf:
[monitor://E:\user05...Nam*[Dd]etai*.[Ll][Oo][Gg]]
I think you can use whitelist. Can you try following configuration?
[monitor:///user05.../]
whitelist = Nam[^/]*.log$
Thank you for your help, Mr. Takjian.
I'd been confused about "source" display of splunk.
I wondered "source" was less than monitor files.
But the monitor files had duplicated contents. Same lines were recorded on files in different directories.
Then the "source" was less than monitor files.
It seems that there is no lack of file contents.
I'm sorry about my confusion.
I think you can use whitelist. Can you try following configuration?
[monitor:///user05.../]
whitelist = Nam[^/]*.log$