Which file will be matched for the following monitor stanza in inputs. conf?

The correct answer is C. /var/log/host_460352847/bar/foo.txt. The monitor stanza [monitor:///var/log//bar/.txt] uses single-level wildcard matching. In Splunk monitor paths, a single '' matches exactly one path segment (one directory level), not recursive subdirectories. Parsing the pattern: '/var/log/' + one directory level () + '/bar/' +

Configuration Files

Question

Options

A[monitor: ///var/log//bar/. txt]
B/var/log/host_460352847/temp/bar/file/csv/foo.txt
C/var/log/host_460352847/bar/foo.txt
D/var/log/host_460352847/bar/file/foo.txt
E/var/ log/ host_460352847/temp/bar/file/foo.txt

How the community answered

(15 responses)

A
7% (1)
B
13% (2)
C
73% (11)
D
7% (1)

Explanation

The monitor stanza [monitor:///var/log//bar/.txt] uses single-level wildcard matching. In Splunk monitor paths, a single '' matches exactly one path segment (one directory level), not recursive subdirectories. Parsing the pattern: '/var/log/' + one directory level () + '/bar/' + one filename ending in .txt (*). Option C - /var/log/host_460352847/bar/foo.txt - matches perfectly: 'host_460352847' satisfies the first *, and 'foo.txt' satisfies *.txt with bar directly preceding it. Option D fails because 'file' is an extra directory between bar and foo.txt. Options B and E fail because 'temp' consumes the *, leaving no wildcard to match 'bar' as a literal segment.

Topics

#inputs.conf#Monitor stanza#Wildcard matching#File input

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice