I don't think there is a practical limit. Unless this has changed in newer versions, Splunk implements wildcards in the monitor stanza using whitelist and blacklist under the covers. So, your rule of
[monitor:///nfsmount/log/log.d*_vd*hoge*/*/*/aaa_*_bb*-ccc*.log]
Translates underneath to something like:
[monitor:///nfsmount/log]
whitelist=^/nfsmount/log/log\.d[^/]*_vd[^/]*hoge/[^/]*/[^/]*/aaa_[^/]*_bb_[^/]*-ccc[^/]*\.log$
NOTE: The regex above may not be exactly how Splunk handles this internally, but is meant to be representative of how Splunk might implement it. And I might have just gotten the regex wrong :).
On the one hand, you can implement this yourself (perhaps more easily) using whitelist/blacklist. But, on the other, I am concerned that either way you implement this it will deeply recurse through /nfsmount/log, which may not perform very well, depending on how many files exist in this tree.
