topic What configuration should I add to parse all the 20+ data sources in a server? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/What-configuration-should-I-add-to-parse-all-the-20-data-sources/m-p/631938#M108296 <P>I have 20+ data sources&nbsp; in a server and each data source is over 500MB so splunk is not indexing all the data sources. Please advise what config that i should add to parse all the 20+ data sources in a server.<BR /><BR />[monitor:///var/opt/*/logs/*/mlogging/*/*/*/*/ProxyLog/Proxy.log]<BR />sourcetype = middlewarelog<BR />index = prd<BR />initCrcLength = 512<BR />ignoreOlderThan = 7d<BR />_TCP_ROUTING=if<BR />disabled = false</P> <P>The above input is not parsing all the data sources, it just parsing only one data source and skipping all others in the server. Thanks.</P> Fri, 24 Feb 2023 16:30:29 GMT sathiyasun 2023-02-24T16:30:29Z What configuration should I add to parse all the 20+ data sources in a server? https://community.splunk.com/t5/Getting-Data-In/What-configuration-should-I-add-to-parse-all-the-20-data-sources/m-p/631938#M108296 <P>I have 20+ data sources&nbsp; in a server and each data source is over 500MB so splunk is not indexing all the data sources. Please advise what config that i should add to parse all the 20+ data sources in a server.<BR /><BR />[monitor:///var/opt/*/logs/*/mlogging/*/*/*/*/ProxyLog/Proxy.log]<BR />sourcetype = middlewarelog<BR />index = prd<BR />initCrcLength = 512<BR />ignoreOlderThan = 7d<BR />_TCP_ROUTING=if<BR />disabled = false</P> <P>The above input is not parsing all the data sources, it just parsing only one data source and skipping all others in the server. Thanks.</P> Fri, 24 Feb 2023 16:30:29 GMT https://community.splunk.com/t5/Getting-Data-In/What-configuration-should-I-add-to-parse-all-the-20-data-sources/m-p/631938#M108296 sathiyasun 2023-02-24T16:30:29Z Re: I have 20+ data sources need to create inputs.conf https://community.splunk.com/t5/Getting-Data-In/What-configuration-should-I-add-to-parse-all-the-20-data-sources/m-p/632192#M108313 <P>Hard to know without knowing what you really have on disk. Check output of</P><PRE>splunk list monitor</PRE><P>and</P><PRE>splunk list inputstatus</PRE><P>That can hint you what's wrong</P> Fri, 24 Feb 2023 12:55:14 GMT https://community.splunk.com/t5/Getting-Data-In/What-configuration-should-I-add-to-parse-all-the-20-data-sources/m-p/632192#M108313 PickleRick 2023-02-24T12:55:14Z