Input.conf issue monitoring same directory multiple times

[Naa_Win]

I have a inputs.conf where it will monitor all the files from a folder 

[monitor:///mydata/my_folder/ToSplunk/*.(mylogfile|edi.mylogfile|edi)]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
crcSalt = <SOURCE>

Also, I wanted to monitor same directory with different files as a different sourcetype. Also these two stanza will have respective props. 

[monitor:///mydata/my_folder/ToSplunk/*.ABC.xml.ToSplunk.edi]
index = xyz
sourcetype = XYZ_SRCTYPE:ABC
_TCP_ROUTING = dev_indexers,qa_indexers
crcSalt = <SOURCE>

[Naa_Win · Accepted solution]

Hello @gcusello ,

Thanks for the reply. 

I had tried this way...
included blacklist to get rid of the (ABC.xml.ToSplunk.edi) file from falling under that sourcetype and made new stanza to take up other sourcetype, that worked !!

[monitor:///mydata/my_folder/ToSplunk/*.(mylogfile|edi.mylogfile|edi)]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
blacklist= (ABC.xml.ToSplunk.edi)
crcSalt = <SOURCE>

[monitor:///mydata/my_folder/ToSplunk/*.ABC.xml.ToSplunk.edi]
index = xyz
sourcetype = XYZ_SRCTYPE:ABC
_TCP_ROUTING = dev_indexers,qa_indexers
crcSalt = <SOURCE>

I had similar issue with the source, can you help me how this works?
https://community.splunk.com/t5/Deployment-Architecture/stanza-for-inputs-conf-is-not-working/m-p/65... 

[gcusello]

Hi @Naa_Win,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @Naa_Win,

at first you cannot use the OR operator ("|") in the monitor header, you have to use whitelist option:

[monitor:///mydata/my_folder/ToSplunk/]
index = xyz
_TCP_ROUTING = dev_indexers,qa_indexers
sourcetype = XYZ_SRCTYPE
whitelist = *.(mylogfile|edi.mylogfile|edi)
crcSalt = <SOURCE>

thesecond problem is that the last condition in the first stanza also includes the second stanza condition, so you have to use two (or more) different conditions to avoid overlappings.

Ciao.

Giuseppe