Getting Data In

Specific and non-specific stanzas

vqd361
Path Finder

I have some input stanzas that look like this:

[monitor:///opt/app/master_proc*/logs/*]
[monitor:///opt/app/backup_proc*/logs/*]
[monitor:///opt/app/simulator*/logs/*]

All three of those inputs are going to a "qa" index. There are log files in other directories in the same location which I want to send to a "development" index.

I was reading http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories and saw a paragraph that said,

> "Monitor inputs may overlap. So long as the stanza names are different, Splunk Enterprise treats them as independent stanzas and files matching the most specific stanza will be treated in accordance with its settings."

Does that mean I can add a stanza after the ones above that looks like this:

[monitor:///opt/app/*/logs/*]

And it will match any files that do not match the ones above? My understanding from the documentation is that it will since it's less specific than the other three.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Although I have not done it, I would expect exactly that.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!