Deployment Architecture

Multiple stanza in inputs.conf for the same folder

tlam_splunk
Splunk Employee
Splunk Employee

I want to monitor a folder /data/data1 with file inside
-file1, file2, other_log, mail_log

Here is the config
[monitor:///data/data1]
whitelist = file1|file2 <- same result if specifying file*$
disabled = false
index=test1
[monitor:///data/data1]
whitelist=other_log|log_mail
disabled = false
index = test2

Seems only the last stanza works. There is no data going into Splunk for file* in the first stanza

Tags (1)
0 Karma

voldemarlegrand
Engager

One trick is to use dots in path: /data/data1 in one monitor and then /data/./data1 in the another one.

The dot stays in the same directory, but Splunk considers these names as different.

graether
Path Finder

Hello voldemarlegrand,

I have the same issue and liked your trick. But somehow it works in splunk btool inputs list stanza, but not in reality. Splunk stopped logging the data specified with /data/./data1. When I used a less well defined method like /data/data1 and /data/data if I have only a /data/data1 directory then it works. I guess the better solution is to assign indexes by transforms.conf as described at https://docs.splunk.com/Documentation/Splunk/8.0.4/Indexer/Setupmultipleindexes

0 Karma

tlam_splunk
Splunk Employee
Splunk Employee

Got the answer.

The monitor should not have the same name:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Monitorfilesanddirectories
"Monitor inputs may overlap. So long as the stanza names are different, Splunk Enterprise treats them as independent stanzas and files matching the most specific stanza will be treated in accordance with its settings."

Have to better organise the logs by folders.

mikaelbje
Motivator

I wish monitor stanzas were named instead of specifying paths. The current approach makes for a lot of extras steps.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...