Hi All,
Having these 2 monitor stanze in one inputs.conf, but able to get data only for latest one monitor stanza.
In both the file names strings are similar but numbers are changing
Is that because of the crcSalt, it's considering only one "Backup*" file name?
Also do the sourcetype needs to be different incase if we are adding "Backup*" in monitor stanza?
File name for first stanza - BackupJobSummaryReport_3696_6883300_1588_1678235411
File name for second stanza - BackupJobSummaryReport_19068_455837_9176_1678233614
[monitor://\\A11FLSCOMMVAULT\commvault_reports\Final_Report\Backup*]
index = backup
disabled = 0
sourcetype = commvault
crcSalt = <SOURCE>
[monitor://\\A11FLSCOMMVAULT\commvault_reports\LISTAPAC\Backup*]
disabled = 0
index = backup
sourcetype = commvault
crcSalt = <SOURCE>
Hi @sureshkumaar,
monitor inputs are case-sensitive. Is it possible directory or filenames are not the same as \\A11FLSCOMMVAULT\commvault_reports\LISTAPAC\Backup* ?
See what
splunk list monitor
and
splunk list inputstatus
say. If they don't list your files, there's something wrong with settings because your files don't match. If the file is matched but not read due to some reason (too old, not considered as changed and so on), you should see that.
Hi @sureshkumaar,
if you have different file names you should read both the files.
Only one question: have your files an extension (e.g. ".log")?
In linux this path is correct, but in Windows you have to add ".*" at the end.
then, the double backslash at the beginning of "A11FLSCOMMVAULT" means that this is a nework path?
if not you havev to add also "c:".
ciao.
Giuseppe
Hi @gcusello
Yes file names are different, as i mentioned earlier strings will remain as it is and the numbers will keep changing.
But able to get only data from one stanza, the other stanza not forwarding data.
I created separate app and tested by creating a file and added input to the file manually and able to get the data.
Having in same app wasn't working, is that because of same sourcetype using for 2 different sources in the inputs.conf???
the extension is "*.csv"
yes it's the network path works from the windows server
Hi @sureshkumaar,
non you don't need to use two different sourcetype, you could also use one monitor stanza for both the inputs.
I'd add also the extention to the path:
[monitor://\\A11FLSCOMMVAULT\commvault_reports\*\Backup*.csv]
index = backup
disabled = 0
sourcetype = commvault
crcSalt = <SOURCE>
Anyway, the crcSalt is useful if you have the same content in more than one file, if the contetnts are different, youdon't need to use it: please try also without crcSalt.
Ciao.
Giuseppe