https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309094#M58152 <P>Hi All, I am facing the below issue:</P> <P>I am reading few log sources (monitor) from the 3 servers, Server1, Server2 and Server3.<BR /> Along with that, I am also reading a log source (test1.txt) from a shared path (This path is shared across all 3 servers).<BR /> Now, the issue is: the same log source (test1.txt) is indexed twice on Splunk against the host Server2 and Server3.<BR /> Whereas, I want to index this source only once against the server Server1 and not to index for Server2 and Server3.<BR /> Is there a way in config file where I can specify that test1.txt should be monitored only from Server1. <BR /> How can I achieve this? Please help me. regards, Santosh</P> Tue, 17 Oct 2017 07:21:29 GMT santosh_hb 2017-10-17T07:21:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309094#M58152 <P>Hi All, I am facing the below issue:</P> <P>I am reading few log sources (monitor) from the 3 servers, Server1, Server2 and Server3.<BR /> Along with that, I am also reading a log source (test1.txt) from a shared path (This path is shared across all 3 servers).<BR /> Now, the issue is: the same log source (test1.txt) is indexed twice on Splunk against the host Server2 and Server3.<BR /> Whereas, I want to index this source only once against the server Server1 and not to index for Server2 and Server3.<BR /> Is there a way in config file where I can specify that test1.txt should be monitored only from Server1. <BR /> How can I achieve this? Please help me. regards, Santosh</P> Tue, 17 Oct 2017 07:21:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309094#M58152 santosh_hb 2017-10-17T07:21:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309095#M58153 <P>Hi santosh_hb,<BR /> probably you used the same inputs.conf in all the servers, you could use a different one on server1 (with monitoring of test1.txt) than the other two servers (without monitoring of test1.txt).</P> <P>Bye.<BR /> Giuseppe</P> Tue, 17 Oct 2017 08:48:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309095#M58153 gcusello 2017-10-17T08:48:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309096#M58154 <P>Hi Giuseppe, Thanks for the reply. This works fine. I wanted to know if there is any other alternative way where I can just add/modify a single inputs.conf which can be pushed to all 3 servers without pushing separate inputs.conf for server1 and server2 and so-on. </P> Mon, 23 Oct 2017 07:08:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309096#M58154 santosh_hb 2017-10-23T07:08:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309097#M58155 <P>Hi,Did you find solution for that? I need to have common inputs across all servers?</P> Tue, 19 May 2020 12:56:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-index-data-from-a-single-server-when-the-log-path-is-in-a/m-p/309097#M58155 hemendralodhi 2020-05-19T12:56:55Z