What is the difference between the two wildcards ... and -for the monitor stanza in inputs, conf?

Question

Options

• A... is not supported in monitor stanzas
• BThere is no difference, they are interchangable and match anything beyond directory boundaries.
• C
  • matches anything in that specific directory path segment, whereas ... recurses through
• D... matches anything in that specific directory path segment, whereas -recurses through

• A
  6% (2)
• B
  3% (1)
• C
  87% (27)
• D
  3% (1)

Explanation

In inputs.conf monitor stanzas, the two wildcards behave differently in terms of directory traversal. The single asterisk () is a shallow wildcard that matches any characters within a single directory path segment only - it does not cross directory boundaries. The triple dot (...) is a recursive wildcard that traverses into subdirectories at any depth. For example, /var/log/ would match files directly in /var/log/ but not in subdirectories, while /var/log/... would match files in /var/log/ and all nested subdirectories. This distinction is important when configuring file monitoring inputs to control the scope of what Splunk monitors.

No community discussion yet for this question.