Deployment Architecture

Multiple stanza in inputs.conf for the same folder

Splunk Employee
Splunk Employee

I want to monitor a folder /data/data1 with file inside
-file1, file2, other_log, mail_log

Here is the config
whitelist = file1|file2 <- same result if specifying file*$
disabled = false
disabled = false
index = test2

Seems only the last stanza works. There is no data going into Splunk for file* in the first stanza

Tags (1)
0 Karma


One trick is to use dots in path: /data/data1 in one monitor and then /data/./data1 in the another one.

The dot stays in the same directory, but Splunk considers these names as different.

Path Finder

Hello voldemarlegrand,

I have the same issue and liked your trick. But somehow it works in splunk btool inputs list stanza, but not in reality. Splunk stopped logging the data specified with /data/./data1. When I used a less well defined method like /data/data1 and /data/data if I have only a /data/data1 directory then it works. I guess the better solution is to assign indexes by transforms.conf as described at

0 Karma

Splunk Employee
Splunk Employee

Got the answer.

The monitor should not have the same name:
"Monitor inputs may overlap. So long as the stanza names are different, Splunk Enterprise treats them as independent stanzas and files matching the most specific stanza will be treated in accordance with its settings."

Have to better organise the logs by folders.


I wish monitor stanzas were named instead of specifying paths. The current approach makes for a lot of extras steps.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...