topic Re: Getting different sourcetypes from the same source in Getting Data In

Getting different sourcetypes from the same source

Na_Kang_Lim — Mon, 08 Sep 2025 09:35:43 GMT

Hi,

I am configure the apps on the UF from a Deploy Server, and get this weird behavior:

What I am trying to do is assigning the sourcetype "nginx:access" for every file that have this path "/var/log/nginx/access.log*"

However, upon deploying the apps, I see that there are still numerous weird sourcetypes assigning to the source "/var/log/nginx/access.log".

For example, when running

| tstats values(sourcetype) where index=*_linux source=/var/log/nginx/access.log by source

I got:

access-100 access-13 access-204 access-29 access-66 access-7 access-too_small access.log-16 access.log-4 access.log-85 access_combined access_combined_wcookie nginx:access

How do I troubleshoot/fix this?

Re: Getting different sourcetypes from the same source

PrewinThomas — Mon, 08 Sep 2025 09:50:37 GMT

@Na_Kang_Lim

In your first blacklist modify with below,

blacklist = (lastlog|anaconda\.syslog|nginx/access\.log)

And for your second monitor, use direct path.

[monitor:///var/log/nginx/access.log] sourcetype = nginx:access disabled = 0

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Getting different sourcetypes from the same source

livehybrid — Mon, 08 Sep 2025 15:07:22 GMT

Hi @Na_Kang_Lim

Firsly, your /var/log/nginx is specifically targeting access.log (nothing else), you need to update this:

[monitor:///var/log/nginx] whitelist = (^access\.log*)

You should probably also exclude this from the first monitor stanza too:

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Getting different sourcetypes from the same source

PickleRick — Mon, 08 Sep 2025 18:54:41 GMT

Splunk can behave weirdly when you monitor two paths of which one includes the other. For sure there is no automatic exclusion of the "narrower" path from the "wider" one but the overall behaviour can be a bit unpredictable. You can see the effective applied "config" with

splunk list monitor

So the overall best practice is when the paths listed in monitor stanzas don't overlap. If you need to specify separate sourcetypes for different files in a single directory you can use so-called sourcetyper configuration.

Specify the default sourcetype in inputs.conf

[monitor:///var/log/]
sourcetype=whatever

But add overrides in props.conf for specific files

[source:///var/log/nginx/*]
sourcetype=something_else

See https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.4/configure-source-types/override-automatic-source-type-assignment