Splitting sourcetype from a monitor input stanza

[tsunamii]

I am using a Universal Forwarder to monitor the following directories and files, but somehow it is not routing it to the correct sourcetype. Everything seems to be routing to sourcetype of corepoint_error_log instead.


inputs.conf --
[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs\*\CIEngMonSvc.log]
sourcetype = corepoint_error_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs\*\CIEngSvc.log]
sourcetype = corepoint_transaction_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

[splunkIT]

This method will not work because there are conflicts with the stanzas above. You would need to use whitelist in the inputs.conf stanza, along with props.conf and transforms.conf stanzas to route it to the correct sourcetype.


inputs.conf--
[monitor://E:\Program Files (x86)\Corepoint\CIE\Logs]
whitelist = (CIEngMonSvc\.log|CIEngSvc\.log)
sourcetype = corepoint_error_log
index = capsule
ignoreOlderThan = 3d
crcSalt = <SOURCE>

props.conf--
[corepoint_error_log]
TRANSFORMS-transaction_log = transaction_log

transforms.conf--
[transaction_log]
SOURCE_KEY = MetaData:Source
REGEX = CIEngSvc\.log
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::corepoint_transaction_log

[jonuwz]

would you mind explaining the stanza conflict ?