Getting Data In

Is inputs.conf processed in a linear manner?

ericlarsen
Path Finder

Is inputs.conf processed in a linear manner? And once a file falls into a given monitor stanza, does it then stop processing through the inputs.conf?

For instance, say I have 2 monitor stanzas. The first one monitors /data/foo/myFolder/* and the second one monitors /data/foo/*.

I want to assign different sourcetypes to each of these stanzas. Will files in /data/foo/myFolder/ get assigned the correct sourcetype since the files technically fall into both stanzas?

0 Karma

jbouch03
Path Finder

the inputs.conf is linear, and through researching this one it looks like that it can't be done. The reason is that the monitor stanza is actually a modular input from Splunk that contains a checkpoint dir. The checkpoint directory is what helps Splunk determine what events have already been sent or not so that you don't re-ingest the same data over and over. Since the inputs.conf file is linear it should always attach the sourcetype of the first stanza. You can test this theory by playing around with the order of the stanzas and re-ingesting a log file in those folders using btprobe with a --reset flag. Here is the link to the btprobe commands for reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/Troubleshooting/CommandlinetoolsforusewithSupport#...

I'm pretty sure that this can't be done they way you want it though. You can through an individual file based monitor but not a folder monitor.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...