Getting Data In

In inputs.conf for the same directory, why does adding a second stanza for a different sourcetype not return data from the first stanza?

puneethgowda
Communicator

In inputs.conf, one stanza is receiving data for sourcetype=CWTBETAAppServerDbconnectInfo but when i add a 2nd stanza, it is not getting data for sourcetype=CWTBETAChannelInfo.

when i add 2nd stanza, the 1st stanza is not working

[default]
host = BLRVMDBENAPP01

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAAppServerDbconnectInfo
whitelist = AppServerDbconnectInfo(\d{8})-(\d{2}).txt$

[monitor://D:\HotelHub\Log4NetLogs]
disable = 0
ignoreOlderThan= 1d
index=CWT
sourcetype=CWTBETAChannelInfo
whitelist = ChannelInfo(\d{8})-(\d{2}).txt$

Regards,

Puneeth

0 Karma
1 Solution

puneethgowda
Communicator

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

View solution in original post

0 Karma

puneethgowda
Communicator

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you have two stanzas with the exact same name, the second replaces the first. To be more precise, the two stanzas are merged into one. Merging is by attribute name only - the value of the last attribute wins.

You can use btool to see how stanzas will be applied by Splunk. Run splunk btool inputs list <sourcetype>.

---
If this reply helps you, Karma would be appreciated.

splunkoptimus
Path Finder

I had a similar problem, there were two _TCP_ROUTING attributes under one input stanza, the second attribute was overriding the first one. 

Tags (2)
0 Karma

puneethgowda
Communicator

01-27-2017 13:41:50.100 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs
01-28-2017 11:10:24.728 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs

0 Karma

rjthibod
Champion

It might be worthwhile to try adding the file monitor via the command line in order to see how Splunk formats the stanza and then compare to your configuration file.

<SPLUNK_ROOT>\bin\splunk add monitor D:\HotelHub\Log4NetLogs

0 Karma

puneethgowda
Communicator

nothing worked as expected so we are moving all the logs to one index and one source type and searching based on source="filename" this is working great

0 Karma

puneethgowda
Communicator

01-27-2017 13:41:50.100 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs
01-28-2017 11:10:24.728 WARN IniFile - C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 5: Cannot parse into key-value pair: D:HotelHubLog4NetLogs

This is what b tool is saying

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...