Monitoring two different paths in inputs.conf, why am I only getting logs from one path, but not the second path?

[pavanae]

Hi the following is my inputs.conf

[monitor:///opt/jboss/server/*/log/server.log]
index = sit_2
sourcetype = log4j

[monitor:///opt/jboss/server/shared/logs/*/server.log]
index = sit_2
sourcetype = log4j

I am able to get logs from first path, but i wasn't able to get logs from the second path. I have checked whether the path is wrong, but i'ts correct and I also checked whether that path doesn't have splunk permissions, but it has permission.

I still can't see the logs from that particular path even though its seems everything was perfect.

Please tell me what might be the issue?

[woodcock · Accepted solution]

This will work:

[monitor:///opt/jboss/server/.../log/server.log]
index = sit_2
sourcetype = log4j

If that doesn't work then this is probably what is happening:

http://answers.splunk.com/answers/35210/crcsalt-issue.html