Getting Data In

Specifying a catch-all in inputs.conf?

mickeander
Loves-to-Learn

Hi,

 

If i have a directory structure like this:

/logs/server1

/logs/server2

/logs/server3

 

And i have set specific inputs.conf stanzas for server 1,2 and 3, but i also want to catch everything that ends up in /logs/, could i set the server1-3 stanzas and have a catch all stanza, or will that catch all stanza collect the logs from server 1-3 again?

 

 

 

 

[monitor:///logs/server1]
host_segment = 2
index = foo
sourcetype = aaa

[monitor:///logs/server3]
host_segment = 2
index = bar
sourcetype = bbb

[monitor:///logs/server3]
host_segment = 2
index = baz
sourcetype = ccc

[monitor:///logs]
index = unknown

 

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...