Exam4Training

What is the difference between the two wildcards … and – for the monitor stanza in inputs, conf?

What is the difference between the two wildcards … and – for the monitor stanza in inputs, conf?
A . … is not supported in monitor stanzas
B . There is no difference, they are interchangable and match anything beyond directory boundaries.
C . * matches anything in that specific directory path segment, whereas … recurses through subdirectories as well.
D . … matches anything in that specific directory path segment, whereas – recurses through subdirectories as well.

Answer: C

Explanation:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Specifyinputpathswithwildcards

… The ellipsis wildcard searches recursively through directories and any number of levels of subdirectories to find matches.

If you specify a folder separator (for example, //var/log/…/file), it does not match the first folder level, only subfolders.

* The asterisk wildcard matches anything in that specific folder path segment. Unlike …, * does not recurse through subfolders.

Exit mobile version