Hi,
I've spent one day trouble-shooting this issue but still don't have any luck.
The files I want to forward are a pretty standard .csv with custom timestamps. So I created a sourcetype and an index for them.
Then I added this stanza in "~/etc/system/local/inputs.conf", monitoring a directory:
[monitor:///splunk-files/data_live/]
disabled = false
index = main
sourcetype = serv_req_final
But I noticed that the files are not correctly forwarded to the correct index and not parsed to the correct sourcetype. Instead, they are indexed by the "main" index and the sourcetype is "csv".
I've tried to restart forwarder instance and the Splunk enterprise instance, cleaned event data several times. But nothing worked... Also I tried to remove the monitor stanza, and the monitor was gone (proving that there's no other conflicting input configurations).
Has anyone ran into similar issues?
It is really frustrating because what I am trying to do is what I consider really basic..
