https://community.splunk.com/t5/Getting-Data-In/Monitoring-files-from-multiple-inputs/m-p/54985#M10703 <P>In general terms these two directories separate entities. While they are in the same tree, these have different inodes and you can monitor each individually. So, the answer to your question is to create two (2) separate entries in inputs.conf.</P> <PRE><CODE>[monitor:///var/lib/usr] sourcetype = answers-1370379558 [monitor:///var/lib/newuser/usr] sourcetype = answers-1370379591 </CODE></PRE> <HR /> <P>Is there more to your question?</P> Tue, 04 Jun 2013 21:00:34 GMT Gilberto_Castil 2013-06-04T21:00:34Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-files-from-multiple-inputs/m-p/54984#M10702 <P>How can I set my monitor in inputs.conf so that both of these directories are monitored-<BR /> 1./var/lib/usr<BR /> 2. /var/lib/newuser/usr</P> <P>If I do [monitor:///var/lib/.../usr/] - will that work for both? Or will that assume that there is at least one subdirectory between "lib" and "usr"</P> <P>Thanks in advance!</P> Tue, 04 Jun 2013 18:00:58 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-files-from-multiple-inputs/m-p/54984#M10702 anna_kendrik 2013-06-04T18:00:58Z https://community.splunk.com/t5/Getting-Data-In/Monitoring-files-from-multiple-inputs/m-p/54985#M10703 <P>In general terms these two directories separate entities. While they are in the same tree, these have different inodes and you can monitor each individually. So, the answer to your question is to create two (2) separate entries in inputs.conf.</P> <PRE><CODE>[monitor:///var/lib/usr] sourcetype = answers-1370379558 [monitor:///var/lib/newuser/usr] sourcetype = answers-1370379591 </CODE></PRE> <HR /> <P>Is there more to your question?</P> Tue, 04 Jun 2013 21:00:34 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-files-from-multiple-inputs/m-p/54985#M10703 Gilberto_Castil 2013-06-04T21:00:34Z