The layout of your logs or your application may dictate a recursive approach.
For instance, say we have these stanzas:
[monitor:///opt/*/logs/access.log*] sourcetype=access [monitor:///opt/.../important.log*] sourcetype=important
The character * will match a single file or directory, while ... will match any depth. This will match the files you want, with the caveat that all of /opt will continually be scanned.
Splunk will continually scan all directories from the first wildcard in a monitor path.
If /opt contains many files and directories, which it almost certainly does, Splunk will use an unfortunate amount of resources scanning all directories for matching files, constantly using memory and CPU. I have seen ...
