Getting Data In

Inputs hierarchy

New Member


I want to monitor a directory but within that directory is another directory which I want to index under a different Source Type.

sourcetype syslog

and the subfolder
sourcetype apache_error

But the second input falls under the first, and since data isn't indexed twice, I'm wondering how splunk is going to handle this.
Will it just index the apache logs with the first rule with sourcetype syslog. Or is splunk smart enough to index the apache logs with the sourcetype apache_error if i define the second input like that.
Or do I put the apache data input before the other one?
Or do I blacklist the folder in the first input rule, if so, how?

0 Karma


Use a blacklist within the first stanza to avoid indexing the Apache logs as syslog.

sourcetype = syslog
# blacklist uses a regular expression, not a pattern
blacklist = (.*apache2.*)

sourcetype = apache_error
If this reply helps you, an upvote would be appreciated.
0 Karma