Let's say I have the following in my inputs.conf file:
[monitor:///splunk/splink/fish/abc_qa/logs/]
whitelist = def.log$|ghi.log$|jkl.log$|mno.log$|pqr*.log$
sourcetype = applogs
index = risk
disabled = false
crcSalt=<source>
And the directory contains the following files:
def_QA_BOAT.log
ghi_QA_TROUT.log
pqr_QA_worm_count.log
Why don't any of these match?