Getting Data In

Why isn't the universal forwarder processing all the monitor stanzas in inputs.conf for multiple folders on a Kiwi syslog server?

fdarrigo
Path Finder

Newbie question - I have an inputs.conf which is configured to monitor multiple folders on a Kiwi syslog server. Every host logging to Kiwi writes a CSV to a separate folder based on the remote device's IP. For example, device "a.a.a.a" writes to d:\kiwilog\a.a.a.a

Some stanzas are being processed (I can see the data in Splunk), but others are not (from what I can tell). Please look at my redacted Inputs.conf (below) and let me know if I have made an error in this file. If everything looks fine, I would appreciate any debugging advice.
Thanks

[default]
host = 

[monitor://D:\kiwilog\x.x.x.x]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0


[monitor://D:\kiwilog\y.y.y.y]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0

[monitor://D:\kiwilog\a.a.a.a]
whitelist=\*.csv$
connection_host=ip
sourcetype=synology:nas
index=nas
disabled=0

[monitor://D:\kiwilog\b.b.b.b]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\c.c.c.c]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\d.d.d.d]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0
0 Karma
1 Solution

fdarrigo
Path Finder

the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected

View solution in original post

fdarrigo
Path Finder

the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!