Getting Data In

Input Monitor order of precedence

sean193
Explorer

Hi,

Will Splunk use a more explicit Monitor stanza vs a wildcard stanza.  Since the stanza's are not identical I do not believe Splunk merges and applies lexicographical order so which stanze wins for the monitored file?  My assumption is the more explicit stanza but I can't fing documentation to back that up. 

Example:
[monitor:///var/log/]
index = linux
vs.
[monitor:///var/log/secure.log]
index = main

0 Karma
1 Solution

sean193
Explorer

Well after testing the explicit stanza wins, atleast in the case below.  Secure when to main, not linux.  This makes since to me just wish it was documented as I could see other people having questions like this. 

[monitor:///var/log]
index = linux
disabled = 0

[monitor:///var/log/secure]
disabled = false

View solution in original post

sean193
Explorer

Feedback as submitted to the doc team.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try it, find out, and report back.  If the data from secure.log appears in index=main then you know the specific stanza trumps the general one.  I suspect that is not the case, however.

Also, splunk list monitor on the monitoring instance may shed some light on what is being monitored.

If the specific stanza ends up duplicating the general one then you should be able to work around it with a blacklist.

[monitor:///var/log/]
index = linux
blacklist = secure\.log

[monitor:///var/log/secure.log]
index = main
---
If this reply helps you, an upvote would be appreciated.

sean193
Explorer

Well after testing the explicit stanza wins, atleast in the case below.  Secure when to main, not linux.  This makes since to me just wish it was documented as I could see other people having questions like this. 

[monitor:///var/log]
index = linux
disabled = 0

[monitor:///var/log/secure]
disabled = false

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Thanks for reporting back.  Be sure to accept your answer to help future readers find the solution.

Consider submitting feedback on the documentation page.  The Docs team is very good about clarifying the pages in response to user feedback.

---
If this reply helps you, an upvote would be appreciated.
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!