https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353751#M19343 <P>I wish monitor stanzas were named instead of specifying paths. The current approach makes for a lot of extras steps. </P> Thu, 28 Sep 2017 07:08:53 GMT mikaelbje 2017-09-28T07:08:53Z https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353748#M19340 <P>I want to monitor a folder /data/data1 with file inside<BR /> -file1, file2,&nbsp;other_log,&nbsp;mail_log</P> <P>Here is the config<BR /> [monitor:///data/data1] <BR /> whitelist = file1|file2 &lt;- same result if specifying file*$ <BR /> disabled = false <BR /> index=test1 <BR /> [monitor:///data/data1] <BR /> whitelist=other_log|log_mail <BR /> disabled = false <BR /> index = test2</P> <P>Seems only the last stanza works. There is no data going into Splunk for file* in the first stanza</P> Tue, 29 Sep 2020 13:52:24 GMT https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353748#M19340 tlam_splunk 2020-09-29T13:52:24Z https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353749#M19341 <P>Got the answer.</P> <P>The monitor should not have the same name:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Monitorfilesanddirectories">http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Monitorfilesanddirectories</A><BR /> "Monitor inputs may overlap. So long as the stanza names are different, Splunk Enterprise treats them as independent stanzas and files matching the most specific stanza will be treated in accordance with its settings." </P> <P>Have to better organise the logs by folders. </P> Fri, 28 Apr 2017 09:48:31 GMT https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353749#M19341 tlam_splunk 2017-04-28T09:48:31Z https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353750#M19342 <P>One trick is to use dots in path: <CODE>/data/data1</CODE> in one monitor and then <CODE>/data/./data1</CODE> in the another one.</P> <P>The dot stays in the same directory, but Splunk considers these names as different.</P> Fri, 04 Aug 2017 09:38:28 GMT https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353750#M19342 voldemarlegrand 2017-08-04T09:38:28Z https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353751#M19343 <P>I wish monitor stanzas were named instead of specifying paths. The current approach makes for a lot of extras steps. </P> Thu, 28 Sep 2017 07:08:53 GMT https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/353751#M19343 mikaelbje 2017-09-28T07:08:53Z https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/506350#M19344 <P>Hello voldemarlegrand,</P><P>I have the same issue and liked your trick. But somehow it works in splunk btool inputs list stanza, but not in reality. Splunk stopped logging the data specified with /data/./data1. When I used a less well defined method like /data/data1 and /data/data if I have only a /data/data1 directory then it works. I guess the better solution is to assign indexes by transforms.conf as described at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Setupmultipleindexes" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Setupmultipleindexes</A></P> Fri, 26 Jun 2020 18:42:18 GMT https://community.splunk.com/t5/Deployment-Architecture/Multiple-stanza-in-inputs-conf-for-the-same-folder/m-p/506350#M19344 graether 2020-06-26T18:42:18Z