Which file will be matched for the following monitor stanza in inputs. conf? [monitor:///var/log//bar/.../.txt]

The correct answer is C. /var/log/host_494488915/bar/file/foo.txt. In Splunk monitor stanza glob syntax, '' matches exactly one path segment (no directory separators), and '...' matches one or more path segments (any depth). For the pattern /var/log//bar/.../.txt: '' must match a single directory (e.g., host_494488915), '/bar/' must match litera

Configuration Files

Question

Which file will be matched for the following monitor stanza in inputs. conf? [monitor:///var/log//bar/…/.txt]

Options

A/var/log/host_494488915/bar/foo.txt
B/var/log/host_494488915/temp/bar/file/foo.txt
C/var/log/host_494488915/bar/file/foo.txt
D/var/log/host_494488915/temp/bar/file/csv/foo.txt

How the community answered

(59 responses)

A
5% (3)
B
8% (5)
C
71% (42)
D
15% (9)

Explanation

In Splunk monitor stanza glob syntax, '' matches exactly one path segment (no directory separators), and '...' matches one or more path segments (any depth). For the pattern /var/log//bar/.../.txt: '' must match a single directory (e.g., host_494488915), '/bar/' must match literally, '...' must match one or more subdirectories, and '.txt' matches any .txt filename. Option C (/var/log/host_494488915/bar/file/foo.txt) satisfies all conditions: ''=host_494488915, bar=bar, '...'=file, .txt=foo.txt. Option A fails because '...' requires at least one directory level between bar/ and foo.txt. Options B and D fail because '' cannot span multiple directory levels (host_494488915/temp).

Topics

#inputs.conf#monitor stanza#wildcard matching#file path globbing

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice