What is the difference between these two configurations in inputs.conf on Universal Forwarder?

[kteng2024]

Under inputs.conf on Universal Forwarder (UF), i have these config as below:-

1.) [monitor:///var/home/jboss/logs/*.log]
disabled = false
followTail = 0
sourcetype= xyz

2.) [monitor:///export/home/tomcat/*.log]
disabled = false
followTail = 0
index = abc_tomcat
sourcetype = pqrs

My questions are ,
a.) index is not configured in 1st monitor stanza whereas index is configured in 2nd monitor stanza, so where will the 1st monitor stanza logs will be going , to the main_index ?

b.) is this really a good configuration ?

c.) do we really need followTail=0 , this option is only used by Splunk for the first time it is monitoring this log which says to read from first line

d) any Suggestions to change this configuration of monitor stanza ?

[somesoni2 · Accepted solution]

My Answers are ,
a.) index is not configured in 1st monitor stanza whereas index is configured in 2nd monitor stanza, so where will the 1st monitor stanza logs will be going , to the main_index ?
** It'll go to the default index which is 'main'. This setting is setup in $Splunk_Home/etc/system/default/inputs.conf (file which you should never update).**

b.) is this really a good configuration ?
People generally use custom indexes with more relavant name, so that only relevant data is stored together. It also allows you to secure the data without affecting other users.

c.) do we really need followTail=0 , this option is only used by splunk for the first time it is monitoring this log which says to read from first line
Not required. The default value itself is 0 for followTail. It's an advanced configuration which should be used only for very specific cases and carefully.

d) any Suggestions to change this configuration of monitor stanza ?
*Would suggest to provide as custom index name. I'm assuming the word 'mointor' is typo in the first stanza, otherwise correct that as well. If the files to be monitored are following specific name, include the contant portion of the file name so that you're not using 100% wildcarded files. *

[s2_splunk]

Yes, if you don't specify an index, events will be routed to the default index, which is main.
I would call it a best practice to ALWAYS configure sourcetype and index explicitly for any input.

The default for followTail is 0 (false), so specifying it here is redundant.

So the only two differences for these two inputs are the sourcetype attributed and the target index.