Getting Data In

How to monitor two files with different names in the same directory, and index all duplicate events on my receiver?

englishjohn
New Member

I have two different file names in the same directory on a forwarder. The problem is, the data for both files are the same, so how do I allow all the events to be indexed on my receiver side?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Monitor individual files instead of the whole directory.

---
If this reply helps you, Karma would be appreciated.
0 Karma

englishjohn
New Member

How do i monitor individual files ? Is there an example ?

0 Karma

ppablo
Retired

Hi @englishjohn

If the answer by @richgalloway solved your issue, please don't forget to resolve the post by clicking "Accept" directly below his answer. If you're still having issues, please comment with more details.

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In your [monitor://] stanza name, put a path to an individual file instead of to a directory. See http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Inputsconf for more.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...