Getting Data In

Specifying a catch-all in inputs.conf?




If i have a directory structure like this:





And i have set specific inputs.conf stanzas for server 1,2 and 3, but i also want to catch everything that ends up in /logs/, could i set the server1-3 stanzas and have a catch all stanza, or will that catch all stanza collect the logs from server 1-3 again?





host_segment = 2
index = foo
sourcetype = aaa

host_segment = 2
index = bar
sourcetype = bbb

host_segment = 2
index = baz
sourcetype = ccc

index = unknown





Labels (1)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!