Getting Data In

Monitoring files from multiple inputs

anna_kendrik
Engager

How can I set my monitor in inputs.conf so that both of these directories are monitored-
1./var/lib/usr
2. /var/lib/newuser/usr

If I do [monitor:///var/lib/.../usr/] - will that work for both? Or will that assume that there is at least one subdirectory between "lib" and "usr"

Thanks in advance!

Tags (2)
0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

In general terms these two directories separate entities. While they are in the same tree, these have different inodes and you can monitor each individually. So, the answer to your question is to create two (2) separate entries in inputs.conf.

[monitor:///var/lib/usr]
sourcetype = answers-1370379558 

[monitor:///var/lib/newuser/usr]
sourcetype = answers-1370379591 

Is there more to your question?

Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...