Getting Data In

Inputs hierarchy

fdesterke
New Member

Hello,

I want to monitor a directory but within that directory is another directory which I want to index under a different Source Type.

specifcally:
[monitor:///var/log/*]
sourcetype syslog

and the subfolder
monitor:///var/log/apache2/*
sourcetype apache_error

But the second input falls under the first, and since data isn't indexed twice, I'm wondering how splunk is going to handle this.
Will it just index the apache logs with the first rule with sourcetype syslog. Or is splunk smart enough to index the apache logs with the sourcetype apache_error if i define the second input like that.
Or do I put the apache data input before the other one?
Or do I blacklist the folder in the first input rule, if so, how?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use a blacklist within the first stanza to avoid indexing the Apache logs as syslog.

[monitor:///var/log/*]
sourcetype = syslog
# blacklist uses a regular expression, not a pattern
blacklist = (.*apache2.*)

[monitor:///var/log/apache2/*]
sourcetype = apache_error
---
If this reply helps you, an upvote would be appreciated.
0 Karma