Getting Data In

How to configure inputs.conf to separate files monitored in a directory?

PPape
Contributor

Hey Guys,

I'm trying to index Data via File Monitor

[monitor://D:\CDR]
disabled = false
index = cdr
sourcetype = cdr

This works just fine, but now I want to separate the files in this Directory there are

cdr[generic Name]_[Date] 
and cmd[generic Name]_[Date]

so I tried

[monitor://D:\CDR]
disabled = false
index = cdr
sourcetype = cdr
whitelist = ^cdr

[monitor://D:\CDR]
disabled = false
index = cdr
sourcetype = cmr
whitelist = ^cmr

But this doesn't work.
EDIT: No Files are indexed when I use it like shown above

Is my RegEx wrong? What am I doing wrong?

Thanks for Helping!

Tags (2)
0 Karma
1 Solution

PPape
Contributor

The answer was:

 [monitor://D:\CDR\cdr*]
 disabled = false
 index = cdr
 sourcetype = cdr


 [monitor://D:\CDR\cmr*]
 disabled = false
 index = cdr
 sourcetype = cmr

Thanks to s72ucor in the #splunk Channel

View solution in original post

PPape
Contributor

The answer was:

 [monitor://D:\CDR\cdr*]
 disabled = false
 index = cdr
 sourcetype = cdr


 [monitor://D:\CDR\cmr*]
 disabled = false
 index = cdr
 sourcetype = cmr

Thanks to s72ucor in the #splunk Channel

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...