https://community.splunk.com/t5/Getting-Data-In/TCP-ROUTING-Sub-folders-of-monitors-fails/m-p/93394#M19427 <P>Hi,<BR /> Monitoring subfolders of other monitors while using TCP_ROUTING results in subfolders not being indexed.<BR /> Do anyone of you have any experiences with this, or possible workarounds? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Removing the /var/log monitor will get data into to the customer01 and customer02 servers, so i know that the ROUTING is working.</P> <P>Adding additional TCP_ROUTING to /var/log/ do not seem to help.</P> <P>[monitor:///var/log/customer]<BR /> disabled=false<BR /> index=index1y<BR /> blacklist=.(gz|\d+)$<BR /> recursive=false<BR /> _TCP_ROUTING=customer01,customer02</P> <P>[monitor:///var/log]<BR /> disabled = false<BR /> blacklist = (.(gz|bz2|z|zip)|lastlog|wtmp|btmp)$<BR /> followTail = 1<BR /> recursive = false</P> <P>--<BR /> Best regards<BR /> Espen</P> Mon, 28 Sep 2020 09:59:51 GMT efo 2020-09-28T09:59:51Z https://community.splunk.com/t5/Getting-Data-In/TCP-ROUTING-Sub-folders-of-monitors-fails/m-p/93394#M19427 <P>Hi,<BR /> Monitoring subfolders of other monitors while using TCP_ROUTING results in subfolders not being indexed.<BR /> Do anyone of you have any experiences with this, or possible workarounds? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Removing the /var/log monitor will get data into to the customer01 and customer02 servers, so i know that the ROUTING is working.</P> <P>Adding additional TCP_ROUTING to /var/log/ do not seem to help.</P> <P>[monitor:///var/log/customer]<BR /> disabled=false<BR /> index=index1y<BR /> blacklist=.(gz|\d+)$<BR /> recursive=false<BR /> _TCP_ROUTING=customer01,customer02</P> <P>[monitor:///var/log]<BR /> disabled = false<BR /> blacklist = (.(gz|bz2|z|zip)|lastlog|wtmp|btmp)$<BR /> followTail = 1<BR /> recursive = false</P> <P>--<BR /> Best regards<BR /> Espen</P> Mon, 28 Sep 2020 09:59:51 GMT https://community.splunk.com/t5/Getting-Data-In/TCP-ROUTING-Sub-folders-of-monitors-fails/m-p/93394#M19427 efo 2020-09-28T09:59:51Z https://community.splunk.com/t5/Getting-Data-In/TCP-ROUTING-Sub-folders-of-monitors-fails/m-p/93395#M19428 <P>I guess you stumbled on the same "bug" as I did.<BR /> This was my workaround:<BR /> <A href="http://answers.splunk.com/answers/126064/bug-in-universal-forwarder-inputsconf-monitor-and-recursive-false/126243">http://answers.splunk.com/answers/126064/bug-in-universal-forwarder-inputsconf-monitor-and-recursive-false/126243</A></P> Mon, 10 Mar 2014 18:09:17 GMT https://community.splunk.com/t5/Getting-Data-In/TCP-ROUTING-Sub-folders-of-monitors-fails/m-p/93395#M19428 elof 2014-03-10T18:09:17Z