Getting Data In

Monitoring files from multiple inputs

anna_kendrik
Engager

How can I set my monitor in inputs.conf so that both of these directories are monitored-
1./var/lib/usr
2. /var/lib/newuser/usr

If I do [monitor:///var/lib/.../usr/] - will that work for both? Or will that assume that there is at least one subdirectory between "lib" and "usr"

Thanks in advance!

Tags (2)
0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

In general terms these two directories separate entities. While they are in the same tree, these have different inodes and you can monitor each individually. So, the answer to your question is to create two (2) separate entries in inputs.conf.

[monitor:///var/lib/usr]
sourcetype = answers-1370379558 

[monitor:///var/lib/newuser/usr]
sourcetype = answers-1370379591 

Is there more to your question?

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...