Splunk multiple monitering stanza issue

[rameshlpatel]

Hi ,

I am adding here multiple monitoring stanza to filter out different log files and give them source type.

But I am seeing in indexer's search that source SystemErr.log with two different source type i.e.
SystemErrs and SystemErr-Small.

Please suggest me what should i do to not do filter in two diffrent stanzas.

[monitor://E:/fflogs/SystemOut.log]
sourcetype=SystemOuts

[monitor://E:/fflogs/SystemErr.log]
sourcetype=SystemErrs

[monitor://E:/fflogs/]
whitelist=.log$

[rameshlpatel]

Yes, For first two stanza I want to filter out systemout and systemerr logs with specific sourcetype and for all others I have to send as it is.

[lguinn2]

You really should have only one monitor stanza for a directory. The following would be more efficient and work better:

inputs.conf

[monitor://E:\\fflogs\\]
whitelist=SystemErr.log$|SystemOut.log$ 

props.conf

[source::E:\\fflogs\\...\\SystemErr.log]
sourcetype=SystemErrs

[source::E:\\fflogs\\...\\SystemOut.log]
sourcetype=SystemOuts

You might need to set the whitelist differently, depending on what you want.

Note that setting the sourcetype, either in inputs.conf or in props.conf will not change any data that has already been indexed. My guess is that the SystemErr-Small (or SystemErr-TooSmall) was created because when you initially tried to index the data, Splunk could not automatically identify the sourcetype because the input file was too short.

[lguinn2]

props.conf is used in a number of places in Splunk, depending on the attributes that you are setting. Setting the sourcetype is done at input time - so this props.conf belongs on the forwarder.

You can (and probably will) have multiple copies of props.conf. Attibutes that are related to parsing go on the indexer...

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

[rameshlpatel]

Your meaning is I have to put props.conf in forwarder local file with inputs.conf ? Spunk Support suggest me to add props.conf in indexer local file . I am confused.

[lguinn2]

This props.conf file belongs in the same directory as the inputs.conf file

[rameshlpatel]

I tried to configure this in props.conf but some how its not working. That why I have only option to set in inputs.conf file. Please suggest how we can solve this problem i inputs.conf itself.

[somesoni2]

What is the purpose of last stanza? Are you monitoring the whole folder as well?