topic Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data fr in Getting Data In

In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

puneethgowda — Mon, 27 Feb 2017 19:22:54 GMT

In inputs.conf, one stanza is receiving data for sourcetype=CWTBETAAppServerDbconnectInfo but when i add a 2nd stanza, it is not getting data for sourcetype=CWTBETAChannelInfo.

when i add 2nd stanza, the 1st stanza is not working

[default]
host = BLRVMDBENAPP01

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAAppServerDbconnectInfo
whitelist = AppServerDbconnectInfo(\d{8})-(\d{2}).txt$

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAChannelInfo
whitelist = ChannelInfo(\d{8})-(\d{2}).txt$

Regards,

Puneeth

Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

richgalloway — Mon, 27 Feb 2017 20:11:14 GMT

If you have two stanzas with the exact same name, the second replaces the first. To be more precise, the two stanzas are merged into one. Merging is by attribute name only - the value of the last attribute wins.

You can use btool to see how stanzas will be applied by Splunk. Run splunk btool inputs list <sourcetype>.

Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

puneethgowda — Fri, 03 Mar 2017 10:31:55 GMT

01-27-2017 13:41:50.100 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs
01-28-2017 11:10:24.728 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs

This is what b tool is saying

Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

puneethgowda — Fri, 03 Mar 2017 10:32:10 GMT

Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

rjthibod — Fri, 03 Mar 2017 11:29:24 GMT

It might be worthwhile to try adding the file monitor via the command line in order to see how Splunk formats the stanza and then compare to your configuration file.

<SPLUNK_ROOT>\bin\splunk add monitor D:\HotelHub\Log4NetLogs

Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

puneethgowda — Thu, 13 Apr 2017 19:56:23 GMT

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

puneethgowda — Thu, 13 Apr 2017 19:56:51 GMT

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

Re: In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data fr

splunkoptimus — Thu, 01 Sep 2022 09:41:02 GMT

I had a similar problem, there were two _TCP_ROUTING attributes under one input stanza, the second attribute was overriding the first one.