topic Re: Can multiple sourcetypes be monitored from the same path in Getting Data In

Can multiple sourcetypes be monitored from the same path

tim9gray — Mon, 28 Sep 2020 14:36:28 GMT

I know that this question has been asked quite a few times, but I have not been able to resolve this. Can I monitor multiple sourcetypes from the same path? The answer seems to be yes, but this just wont work for me.

If I specify two monitors that reference the same directory, I only get data from the second monitor stanza in my inputs.conf. I suspect there is something subtle happening here I have not picked up on. Does anyone have any suggestions? Below is an example
of the inputs.conf I have been using.

[monitor:///home/bob/time_data.csv]
sourcetype = DGC_TIME
index=main

[monitor:///home/bob/pulse_data.csv]
sourcetype = DGC_PULSE
index=main

Re: Can multiple sourcetypes be monitored from the same path

gfuente — Tue, 20 Aug 2013 07:20:48 GMT

Hello

For sure you can do that, and for your particular problem, i would check file permissions, as your configuration appears to be fine.

Regards

Re: Can multiple sourcetypes be monitored from the same path

kristian_kolb — Tue, 20 Aug 2013 07:57:45 GMT

To find out what the TailingProcessor is (not) doing, you can look in the splunkd.log or perhaps more easily query the REST interface directly:

Go to the machine where the inputs.conf file is at (forwarder or indexer). You need to authenticate with the correct admin password for that instance (admin/changeme) if still at default.

https://your_host:8089/services/admin/inputstatus/TailingProcessor:FileStatus

Scroll down until you find your file and the corresponding status message.

This link may also be helpful;

http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

Re: Can multiple sourcetypes be monitored from the same path

HiroshiSatoh — Wed, 21 Aug 2013 01:10:47 GMT

I tried in the same setting, but it went well. This is version 5.0.3 of the Linux.

However, it failed the wrong character encoding of the CSV file first.

Re: Can multiple sourcetypes be monitored from the same path

tim9gray — Sat, 24 Aug 2013 15:08:15 GMT

I figured it out. The files I was interested in all started with exactly the first eleven lines, so Splunk thought they were all the same file. I had to use the crcsalt option in inputs.conf.