Getting Data In

In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

puneethgowda
Communicator

In inputs.conf, one stanza is receiving data for sourcetype=CWTBETAAppServerDbconnectInfo but when i add a 2nd stanza, it is not getting data for sourcetype=CWTBETAChannelInfo.

when i add 2nd stanza, the 1st stanza is not working

[default]
host = BLRVMDBENAPP01

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAAppServerDbconnectInfo
whitelist = AppServerDbconnectInfo(\d{8})-(\d{2}).txt$

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAChannelInfo
whitelist = ChannelInfo(\d{8})-(\d{2}).txt$

Regards,

Puneeth

0 Karma
1 Solution

puneethgowda
Communicator

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

View solution in original post

0 Karma

puneethgowda
Communicator

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you have two stanzas with the exact same name, the second replaces the first. To be more precise, the two stanzas are merged into one. Merging is by attribute name only - the value of the last attribute wins.

You can use btool to see how stanzas will be applied by Splunk. Run splunk btool inputs list <sourcetype>.

---
If this reply helps you, an upvote would be appreciated.

puneethgowda
Communicator

01-27-2017 13:41:50.100 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs
01-28-2017 11:10:24.728 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs

0 Karma

rjthibod
Champion

It might be worthwhile to try adding the file monitor via the command line in order to see how Splunk formats the stanza and then compare to your configuration file.

<SPLUNK_ROOT>\bin\splunk add monitor D:\HotelHub\Log4NetLogs

0 Karma

puneethgowda
Communicator

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

0 Karma

puneethgowda
Communicator

01-27-2017 13:41:50.100 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs
01-28-2017 11:10:24.728 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs

This is what b tool is saying

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!