Deployment Architecture

Multiple stanza in inputs.conf for the same folder

Splunk Employee
Splunk Employee

I want to monitor a folder /data/data1 with file inside
-file1, file2, other_log, mail_log

Here is the config
whitelist = file1|file2 <- same result if specifying file*$
disabled = false
disabled = false
index = test2

Seems only the last stanza works. There is no data going into Splunk for file* in the first stanza

Tags (1)
0 Karma


One trick is to use dots in path: /data/data1 in one monitor and then /data/./data1 in the another one.

The dot stays in the same directory, but Splunk considers these names as different.

Path Finder

Hello voldemarlegrand,

I have the same issue and liked your trick. But somehow it works in splunk btool inputs list stanza, but not in reality. Splunk stopped logging the data specified with /data/./data1. When I used a less well defined method like /data/data1 and /data/data if I have only a /data/data1 directory then it works. I guess the better solution is to assign indexes by transforms.conf as described at

0 Karma

Splunk Employee
Splunk Employee

Got the answer.

The monitor should not have the same name:
"Monitor inputs may overlap. So long as the stanza names are different, Splunk Enterprise treats them as independent stanzas and files matching the most specific stanza will be treated in accordance with its settings."

Have to better organise the logs by folders.


I wish monitor stanzas were named instead of specifying paths. The current approach makes for a lot of extras steps.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...