Monitoring two different paths in inputs.conf, why am I only getting logs from one path, but not the second path?

pavanae — Tue, 21 Jul 2015 16:19:38 GMT

Hi the following is my inputs.conf

[monitor:///opt/jboss/server/*/log/server.log]
index = sit_2
sourcetype = log4j

[monitor:///opt/jboss/server/shared/logs/*/server.log]
index = sit_2
sourcetype = log4j

I am able to get logs from first path, but i wasn't able to get logs from the second path. I have checked whether the path is wrong, but i'ts correct and I also checked whether that path doesn't have splunk permissions, but it has permission.

I still can't see the logs from that particular path even though its seems everything was perfect.

Please tell me what might be the issue?

Re: Monitoring two different paths in inputs.conf, why am I only getting logs from one path, but not the second path?

woodcock — Fri, 24 Jul 2015 22:46:34 GMT

This will work:

[monitor:///opt/jboss/server/.../log/server.log]
index = sit_2
sourcetype = log4j

If that doesn't work then this is probably what is happening:

http://answers.splunk.com/answers/35210/crcsalt-issue.html

topic Re: Monitoring two different paths in inputs.conf, why am I only getting logs from one path, but not the second path? in Getting Data In

Monitoring two different paths in inputs.conf, why am I only getting logs from one path, but not the second path?

Re: Monitoring two different paths in inputs.conf, why am I only getting logs from one path, but not the second path?