But the second input falls under the first, and since data isn't indexed twice, I'm wondering how splunk is going to handle this.
Will it just index the apache logs with the first rule with sourcetype syslog. Or is splunk smart enough to index the apache logs with the sourcetype apache_error if i define the second input like that.
Or do I put the apache data input before the other one?
Or do I blacklist the folder in the first input rule, if so, how?