What is the difference between the two wildcards ... and * for the monitor stanza in inputs.conf?
What is the difference between the two wildcards ... and * for the monitor stanza in inputs.conf?
The * wildcard matches anything within a single directory path segment, while the ... wildcard recurses through subdirectories to match files at any level within a directory structure.
C. * matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well.
Per the provided Reference URL https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Specifyinputpathswithwildcards ... The ellipsis wildcard searches recursively through directories and any number of levels of subdirectories to find matches. If you specify a folder separator (for example, //var/log/.../file), it does not match the first folder level, only subfolders. * The asterisk wildcard matches anything in that specific folder path segment. Unlike ..., * does not recurse through subfolders.
C is correct