Getting Data In

Can multiple sourcetypes be monitored from the same path


I know that this question has been asked quite a few times, but I have not been able to resolve this. Can I monitor multiple sourcetypes from the same path? The answer seems to be yes, but this just wont work for me.

If I specify two monitors that reference the same directory, I only get data from the second monitor stanza in my inputs.conf. I suspect there is something subtle happening here I have not picked up on. Does anyone have any suggestions? Below is an example
of the inputs.conf I have been using.

sourcetype = DGC_TIME

sourcetype = DGC_PULSE

0 Karma


I tried in the same setting, but it went well. This is version 5.0.3 of the Linux.

However, it failed the wrong character encoding of the CSV file first.

0 Karma

Ultra Champion

To find out what the TailingProcessor is (not) doing, you can look in the splunkd.log or perhaps more easily query the REST interface directly:

Go to the machine where the inputs.conf file is at (forwarder or indexer). You need to authenticate with the correct admin password for that instance (admin/changeme) if still at default.


Scroll down until you find your file and the corresponding status message.

This link may also be helpful;



I figured it out. The files I was interested in all started with exactly the first eleven lines, so Splunk thought they were all the same file. I had to use the crcsalt option in inputs.conf.

0 Karma



For sure you can do that, and for your particular problem, i would check file permissions, as your configuration appears to be fine.