Is inputs.conf processed in a linear manner?

[ericlarsen]

Is inputs.conf processed in a linear manner? And once a file falls into a given monitor stanza, does it then stop processing through the inputs.conf?

For instance, say I have 2 monitor stanzas. The first one monitors /data/foo/myFolder/* and the second one monitors /data/foo/*.

I want to assign different sourcetypes to each of these stanzas. Will files in /data/foo/myFolder/ get assigned the correct sourcetype since the files technically fall into both stanzas?

[jbouch03]

the inputs.conf is linear, and through researching this one it looks like that it can't be done. The reason is that the monitor stanza is actually a modular input from Splunk that contains a checkpoint dir. The checkpoint directory is what helps Splunk determine what events have already been sent or not so that you don't re-ingest the same data over and over. Since the inputs.conf file is linear it should always attach the sourcetype of the first stanza. You can test this theory by playing around with the order of the stanzas and re-ingesting a log file in those folders using btprobe with a --reset flag. Here is the link to the btprobe commands for reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/Troubleshooting/CommandlinetoolsforusewithSupport#...

I'm pretty sure that this can't be done they way you want it though. You can through an individual file based monitor but not a folder monitor.