https://community.splunk.com/t5/Getting-Data-In/2-files-same-data-indexed/m-p/186440#M37352 <P>You will want to use a whitelist in <CODE>inputs.conf</CODE></P> <PRE><CODE>[monitor:///your/path/to/monitor] whitelist = \.log$ sourcetype = your_sourcetype </CODE></PRE> <P>This will exclude anything that doesn't end in .log.</P> Tue, 03 Jun 2014 11:58:22 GMT alacercogitatus 2014-06-03T11:58:22Z https://community.splunk.com/t5/Getting-Data-In/2-files-same-data-indexed/m-p/186438#M37350 <P>Hi,</P> <P>I have 2 files with 1.log and 1.log.gz but they have exact same data. I see that indexer indexes both somehow. </P> <P>firstTime lastTime recentTime source totalCount type<BR /> 1392760800 1392847199 1392847202 /20140219.log 9795685 sources<BR /> 1392760800 1392847199 1393110875 /20140219.log.gz 9795685 sources</P> <P>any idea to have only index 1 of the double data with different file names.!</P> Tue, 03 Jun 2014 07:57:23 GMT https://community.splunk.com/t5/Getting-Data-In/2-files-same-data-indexed/m-p/186438#M37350 safe_splunk 2014-06-03T07:57:23Z https://community.splunk.com/t5/Getting-Data-In/2-files-same-data-indexed/m-p/186439#M37351 <P>What does the monitor section for this input in your inputs.conf contain?</P> Tue, 03 Jun 2014 09:21:20 GMT https://community.splunk.com/t5/Getting-Data-In/2-files-same-data-indexed/m-p/186439#M37351 Ayn 2014-06-03T09:21:20Z https://community.splunk.com/t5/Getting-Data-In/2-files-same-data-indexed/m-p/186440#M37352 <P>You will want to use a whitelist in <CODE>inputs.conf</CODE></P> <PRE><CODE>[monitor:///your/path/to/monitor] whitelist = \.log$ sourcetype = your_sourcetype </CODE></PRE> <P>This will exclude anything that doesn't end in .log.</P> Tue, 03 Jun 2014 11:58:22 GMT https://community.splunk.com/t5/Getting-Data-In/2-files-same-data-indexed/m-p/186440#M37352 alacercogitatus 2014-06-03T11:58:22Z