https://community.splunk.com/t5/Getting-Data-In/Inputs-hierarchy/m-p/353667#M64736 <P>Hello, </P> <P>I want to monitor a directory but within that directory is another directory which I want to index under a different Source Type.</P> <P>specifcally:<BR /> [monitor:///var/log/*]<BR /> sourcetype syslog</P> <P>and the subfolder<BR /> <A href="https://community.splunk.com/which%20contains%20apache%20access%20logs">monitor:///var/log/apache2/*</A><BR /> sourcetype apache_error</P> <P>But the second input falls under the first, and since data isn't indexed twice, I'm wondering how splunk is going to handle this.<BR /> Will it just index the apache logs with the first rule with sourcetype syslog. Or is splunk smart enough to index the apache logs with the sourcetype apache_error if i define the second input like that.<BR /> Or do I put the apache data input before the other one?<BR /> Or do I blacklist the folder in the first input rule, if so, how?</P> Tue, 07 Nov 2017 10:38:03 GMT fdesterke 2017-11-07T10:38:03Z https://community.splunk.com/t5/Getting-Data-In/Inputs-hierarchy/m-p/353667#M64736 <P>Hello, </P> <P>I want to monitor a directory but within that directory is another directory which I want to index under a different Source Type.</P> <P>specifcally:<BR /> [monitor:///var/log/*]<BR /> sourcetype syslog</P> <P>and the subfolder<BR /> <A href="https://community.splunk.com/which%20contains%20apache%20access%20logs">monitor:///var/log/apache2/*</A><BR /> sourcetype apache_error</P> <P>But the second input falls under the first, and since data isn't indexed twice, I'm wondering how splunk is going to handle this.<BR /> Will it just index the apache logs with the first rule with sourcetype syslog. Or is splunk smart enough to index the apache logs with the sourcetype apache_error if i define the second input like that.<BR /> Or do I put the apache data input before the other one?<BR /> Or do I blacklist the folder in the first input rule, if so, how?</P> Tue, 07 Nov 2017 10:38:03 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-hierarchy/m-p/353667#M64736 fdesterke 2017-11-07T10:38:03Z https://community.splunk.com/t5/Getting-Data-In/Inputs-hierarchy/m-p/353668#M64737 <P>Use a blacklist within the first stanza to avoid indexing the Apache logs as syslog.</P> <PRE><CODE>[monitor:///var/log/*] sourcetype = syslog # blacklist uses a regular expression, not a pattern blacklist = (.*apache2.*) [monitor:///var/log/apache2/*] sourcetype = apache_error </CODE></PRE> Tue, 07 Nov 2017 14:08:11 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-hierarchy/m-p/353668#M64737 richgalloway 2017-11-07T14:08:11Z