Can Splunk monitor two directories for Bro?

[voorhees38]

If so, does it require simply a second monitor line in the local/inputs.conf file for the app?

[adonio]

yes,

add another monitor stanza
read here:
http://docs.splunk.com/Documentation/AddOns/released/BroIDS/Configuration
and here:
http://docs.splunk.com/Documentation/AddOns/released/BroIDS/DataTypes

make sure the specify the sourcetype as bro

hope it helps