Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log
Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log
To match all the given log file paths, the monitor stanza needs to traverse through different directory levels. The ellipsis wildcard ('...') is recursive and will match any number of subdirectory levels. Therefore, '[monitor:///var/log/.../secure.*]' will match '/var/log/www1/secure.log', '/var/log/www/secure.l', '/var/log/www/logs/secure.logs', and '/var/log/www2/secure.log' efficiently, as it can account for any subdirectory structures present in the given paths.
Confirmed - A - "The ellipsis wildcard recursesthrough directories and subdirectories to match." "The asterisk wildcard matches anything in that specific directory path segment but does not go beyond that segment in the path. Normally it should be used at the end of a path."
Per Splunk docs reference URL https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Specifyinputpathswithwildcards Wildcard Description Regex equivalent Examples ... The ellipsis wildcard searches recursively through directories and any number of levels of subdirectories to find matches. If you specify a folder separator (for example, //var/log/.../file), it does not match the first folder level, only subfolders. .* /foo/.../bar.log matches /foo/1/bar.log, /foo/2/bar.log, /foo/1/2/bar.log, and so on. It does not match /foo/bar.log or /foo/3/notbar.log. Because a single ellipse searches recursively through all folders and subfolders, /foo/.../bar.log matches /foo/.../.../bar.log.
Answer is A
answer is A
Answer is A
Confirmed - A
There are two different WWW folders. You need ... (three dots variable) to traverse all of them.
Answer is A!!!!!!
The third file has one more layer of subdir so "..." is needed. Therefore A is the only answer.