Getting Data In

Need help writing input stanza for maillog


I'm having a hard time getting my stanza setup correctly. I basically want to monitor the maillog directories (maillog + maillog-date) and choose the best appropriate sourcetype

However the archive maillog directories aren't coming in

Can someone spin me In the right direction on how to better write this stanza? Please resist the urge to send me a splunk doc link as I've been rummaging through those for a while.. it's not clicking


Can someone please help me in rewriting a better stanza

Whitelist =(maillog$)
disabled = false
sourcetype = maillog
Index = linux

Currently it's not working where it's pulling in the archive logs. So anything with a date after maillog isn't getting pulled

I think I tried [monitor:///var/log/maillog*] without the whitelist but it isn't working

Labels (1)
0 Karma


Hey there. Check Splunk's _internal index for any nuggets of info on this issue. This is assuming that the internal logs are being forwarded. If not look at the splunkd.log file on the host that has the input configured.

Splunk btool command may be of use to ensure that this config is even being read or being over ridden somehow. If you are editing the inputs.conf manually make sure that splunkd can read the inputs.conf file.

Just some things that come to mind...

0 Karma

Have you check permission of files and directories, so your splunk user can read those or are you running splunk as root (security risk)?
r. Ismo
0 Karma


Hi, I do have read permission as other logs are coming in


Could you please tell me if: maillog 


Is the correct sourcetype for /var/log/maillog


I saw a few choices but it's unclear what's the best to use. Sendmail_syslog I thought looked promising but there I am guessing again 

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...