Forwarding not working for some directories

[mbrunetto]

I have a unix light forwarder that works fine for the normal default splunk forwarding (the scripts for CPU, ports, etc).

So:
[monitor:///var/log]
whitelist=(\.log|log$|messages$|mesg$|cron$|acpid$|\.out)
blacklist=(lastlog)
index=os
disabled = 0

Produces the expected entries on my indexer.

I added a statement for a custom directory (using a custom index):

[monitor:///services/.../logs]
whitelist=(\.log$|log$|messages$|mesg$|cron$|acpid$|\.out$)
blacklist=(lastlog$|\.gz$|^splunk|\.xml$|\.conf|^metrics)
index=services
disabled = 0

The index is created on the indexer, and 'splunk list monitor' shows the directories are being monitored on the forwarder (including many directories that shouldn't be, but I saw another question that answered that).

With all that, nothing new is added to my new index. What needs to happen to see my data on my indexer?

[amrit]

If possible, use Firefox to visit the Splunk forwarder's management port: https://fwder:8089/services/admin/inputstatus/TailingProcessor:FileStatus

And see what reason is provided for ignoring the files you wish to see indexed.

If it isn't possible to use Firefox, consider: wget --user=foo --password=bar https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus | xmllint --format -

It's most likely just some collision with the regexes (using ... in a stanza creates an implicit whitelist). Let's see what the system thinks it's looking for.