Getting Data In
Highlighted

If I have 2 identical inputs.conf monitor stanzas except for the target indexes, will data be received in both indexes or only the first?

Path Finder

Hello,

I just had a quick question about the inputs.conf file in the Splunk Universal Forwarders.

Let's say, I have these two stanzas in my inputs.conf file:

[monitor:/usr/output.log]
_TCP_ROUTING = *
index = index1
sourcetype = user_logs

[monitor:/usr/output.log]
_TCP_ROUTING = *
index = index2
sourcetype = user_logs

I am curious if data will be received in both indexes, or if the data will only go to the first index?

Thanks,
Matt

0 Karma
Highlighted

Re: If I have 2 identical inputs.conf monitor stanzas except for the target indexes, will data be received in both indexes or only the first?

Esteemed Legend

The data will go to the first index. There are many rules that cover precedence but if everything is identical, the first one will take precedence over the second one. To see what Splunk thinks is being used, run this:

$SPLUNK_HOME/splunk cmd btool inputs list --debug

View solution in original post

Highlighted

Re: If I have 2 identical inputs.conf monitor stanzas except for the target indexes, will data be received in both indexes or only the first?

Legend

You might also want to read the Configuration File Precedence section of the Administration manual to understand how it works. The rules aren't difficult and it will really help you as a Splunk administrator to understand how they work.

As @woodcock points out, btool is a great way to look out the results of the precedence rule operation.