https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-and-Multiple-sourcetypes/m-p/132389#M27236 <P>Is it possible to monitor a directory for files that will be input with different source types (assuming I'd use whitelist) or will I need to create and monitor a differnet directory for each sourcetype?</P> <P>So 1 Directory:</P> <PRE><CODE>[monitor:///apps/splunk/staging/prod/crd/] sourcetype = Windows_Events whitelist = \d+-\S{8}_Windows_Events_\d{8}.csv [monitor:///apps/splunk/staging/prod/crd/] sourcetype = Windows_Users whitelist = \d+-\S{8}_Windows_Users_\d{8}.csv </CODE></PRE> <P>OR 2 dirs:</P> <PRE><CODE>[monitor:///apps/splunk/staging/prod/crd/winEvents] sourcetype = Windows_Events [monitor:///apps/splunk/staging/prod/crd/winUsers] sourcetype = Windows_Users </CODE></PRE> Thu, 07 Nov 2013 13:57:01 GMT andrewkenth 2013-11-07T13:57:01Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-and-Multiple-sourcetypes/m-p/132389#M27236 <P>Is it possible to monitor a directory for files that will be input with different source types (assuming I'd use whitelist) or will I need to create and monitor a differnet directory for each sourcetype?</P> <P>So 1 Directory:</P> <PRE><CODE>[monitor:///apps/splunk/staging/prod/crd/] sourcetype = Windows_Events whitelist = \d+-\S{8}_Windows_Events_\d{8}.csv [monitor:///apps/splunk/staging/prod/crd/] sourcetype = Windows_Users whitelist = \d+-\S{8}_Windows_Users_\d{8}.csv </CODE></PRE> <P>OR 2 dirs:</P> <PRE><CODE>[monitor:///apps/splunk/staging/prod/crd/winEvents] sourcetype = Windows_Events [monitor:///apps/splunk/staging/prod/crd/winUsers] sourcetype = Windows_Users </CODE></PRE> Thu, 07 Nov 2013 13:57:01 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-and-Multiple-sourcetypes/m-p/132389#M27236 andrewkenth 2013-11-07T13:57:01Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-and-Multiple-sourcetypes/m-p/132390#M27237 <P>Go with option no2. That way, there are no uncertainties with how this will be handled by splunk.</P> <P>/K</P> Thu, 07 Nov 2013 21:23:55 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-and-Multiple-sourcetypes/m-p/132390#M27237 kristian_kolb 2013-11-07T21:23:55Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-and-Multiple-sourcetypes/m-p/132391#M27238 <P>Option 2 is nicer and easier to troubleshoot.</P> <P>but there is an option 3 with a single folder. but 2 monitors, and the filter in the path.</P> <P>`<BR /> [monitor:///apps/splunk/staging/prod/crd/.../<EM>Windows_Events</EM>/*.csv]<BR /> sourcetype = Windows_Events</P> <P>[monitor:///apps/splunk/staging/prod/crd/.../<EM>Windows_Users</EM>/*.csv]<BR /> sourcetype = Windows_Users<BR /> `</P> Sun, 10 Nov 2013 18:55:58 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-and-Multiple-sourcetypes/m-p/132391#M27238 yannK 2013-11-10T18:55:58Z