Multiple stanza in inputs.conf for the same folder

[tlam_splunk]

I want to monitor a folder /data/data1 with file inside
-file1, file2, other_log, mail_log

Here is the config
[monitor:///data/data1]
whitelist = file1|file2 <- same result if specifying file*$
disabled = false
index=test1
[monitor:///data/data1]
whitelist=other_log|log_mail
disabled = false
index = test2

Seems only the last stanza works. There is no data going into Splunk for file* in the first stanza

[voldemarlegrand]

One trick is to use dots in path: /data/data1 in one monitor and then /data/./data1 in the another one.

The dot stays in the same directory, but Splunk considers these names as different.

[graether]

Hello voldemarlegrand,

I have the same issue and liked your trick. But somehow it works in splunk btool inputs list stanza, but not in reality. Splunk stopped logging the data specified with /data/./data1. When I used a less well defined method like /data/data1 and /data/data if I have only a /data/data1 directory then it works. I guess the better solution is to assign indexes by transforms.conf as described at https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Setupmultipleindexes

[tlam_splunk]

Got the answer.

The monitor should not have the same name:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Monitorfilesanddirectories
"Monitor inputs may overlap. So long as the stanza names are different, Splunk Enterprise treats them as independent stanzas and files matching the most specific stanza will be treated in accordance with its settings."

Have to better organise the logs by folders.

[mikaelbje]

I wish monitor stanzas were named instead of specifying paths. The current approach makes for a lot of extras steps.