In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

[puneethgowda]

In inputs.conf, one stanza is receiving data for sourcetype=CWTBETAAppServerDbconnectInfo but when i add a 2nd stanza, it is not getting data for sourcetype=CWTBETAChannelInfo.

when i add 2nd stanza, the 1st stanza is not working

[default]
host = BLRVMDBENAPP01

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAAppServerDbconnectInfo
whitelist = AppServerDbconnectInfo(\d{8})-(\d{2}).txt$

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAChannelInfo
whitelist = ChannelInfo(\d{8})-(\d{2}).txt$

Regards,

Puneeth

[puneethgowda · Accepted solution]

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

[richgalloway]

If you have two stanzas with the exact same name, the second replaces the first. To be more precise, the two stanzas are merged into one. Merging is by attribute name only - the value of the last attribute wins.

You can use btool to see how stanzas will be applied by Splunk. Run splunk btool inputs list <sourcetype>.

[splunkoptimus]

I had a similar problem, there were two _TCP_ROUTING attributes under one input stanza, the second attribute was overriding the first one. 

[puneethgowda]

01-27-2017 13:41:50.100 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs
01-28-2017 11:10:24.728 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs

[rjthibod]

It might be worthwhile to try adding the file monitor via the command line in order to see how Splunk formats the stanza and then compare to your configuration file.

<SPLUNK_ROOT>\bin\splunk add monitor D:\HotelHub\Log4NetLogs

[puneethgowda]

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

[puneethgowda]

01-27-2017 13:41:50.100 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs
01-28-2017 11:10:24.728 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs

This is what b tool is saying