https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133117#M27349 <P>Whats a SUF?</P> Tue, 08 Jul 2014 04:20:21 GMT Dark_Ichigo 2014-07-08T04:20:21Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133115#M27347 <P>Only the first Stanza works, when I comment out one of them, it works fine, but no matter what happens, I cant get them both to work...</P> <P>Only highlighted logs are forwarded.</P> <PRE><CODE># logs1 [monitor:///home/mmm/logs/mmm.log*] sourcetype = Core index = CoreLog _TCP_ROUTING = umm #recursive = false #whitelist = mmm\.log(\.1)? # logs2 [monitor:///home/mmm/logs/mmm/smmm.log*] sourcetype = CoreSMS index = CoreLog _TCP_ROUTING = umm whitelist = smmm\.log(\.\d+\-\d+\-\d+)? </CODE></PRE> Tue, 08 Jul 2014 03:34:17 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133115#M27347 Dark_Ichigo 2014-07-08T03:34:17Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133116#M27348 <P>Have you tried like this:</P> <PRE><CODE># logs1 [monitor:///home/mmm/logs/mmm.log*] sourcetype = Core index = CoreLog _TCP_ROUTING = umm recursive = false # logs2 [monitor:///home/mmm/logs/mmm/smmm.log*] sourcetype = CoreSMS index = CoreLog _TCP_ROUTING = umm recursive = false </CODE></PRE> <P>Also, does your SUF shows any error message in the logs?</P> Tue, 08 Jul 2014 03:45:52 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133116#M27348 musskopf 2014-07-08T03:45:52Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133117#M27349 <P>Whats a SUF?</P> Tue, 08 Jul 2014 04:20:21 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133117#M27349 Dark_Ichigo 2014-07-08T04:20:21Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133118#M27350 <P>Splunk Universal Forwarder. I imagine tei config you pasted there in not from the inputs.conf on the Splunk Server but from some other box running a forwarder (splunk agent)</P> Tue, 08 Jul 2014 04:22:46 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133118#M27350 musskopf 2014-07-08T04:22:46Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133119#M27351 <P>Sorry, I have tried the above on multiple instances, but the same issue remains....</P> <P>Could this be due to the fact that #log2 stanza is pointing at a Sub directory as opposed to the #log1 stanza which is one directory above it??</P> Tue, 08 Jul 2014 06:30:47 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133119#M27351 Dark_Ichigo 2014-07-08T06:30:47Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133120#M27352 <P>Yeah, it might be a bug actually. Have a look on this post:</P> <P><A href="http://answers.splunk.com/answers/126064/bug-in-universal-forwarder-inputsconf-monitor-and-recursive-false">http://answers.splunk.com/answers/126064/bug-in-universal-forwarder-inputsconf-monitor-and-recursive-false</A></P> Tue, 08 Jul 2014 22:48:11 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-forwarding-from-the-same-directory-issue/m-p/133120#M27352 musskopf 2014-07-08T22:48:11Z