Getting Data In

Specifying a catch-all in inputs.conf?




If i have a directory structure like this:





And i have set specific inputs.conf stanzas for server 1,2 and 3, but i also want to catch everything that ends up in /logs/, could i set the server1-3 stanzas and have a catch all stanza, or will that catch all stanza collect the logs from server 1-3 again?





host_segment = 2
index = foo
sourcetype = aaa

host_segment = 2
index = bar
sourcetype = bbb

host_segment = 2
index = baz
sourcetype = ccc

index = unknown





Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!