Getting Data In

How to monitor 2 different file types in the same folder

Splunk Employee
Splunk Employee

If I need to monitor 2 different file types in the same folder and send them to different indexes, how do I do that?

Tags (2)

Splunk Employee
Splunk Employee

I would setup 2 separate monitor stanzas that monitor the folder.
In each stanza I would create a whitelist for the specific file type, such as:

[monitor:///mnt/logs/*.log]
index=test1

[monitor:///mnt/logs/*.txt]
index=test2

This should direct the .log events to the test1 index and send .txt to test2.