Getting Data In

Why isn't the universal forwarder processing all the monitor stanzas in inputs.conf for multiple folders on a Kiwi syslog server?

fdarrigo
Path Finder

Newbie question - I have an inputs.conf which is configured to monitor multiple folders on a Kiwi syslog server. Every host logging to Kiwi writes a CSV to a separate folder based on the remote device's IP. For example, device "a.a.a.a" writes to d:\kiwilog\a.a.a.a

Some stanzas are being processed (I can see the data in Splunk), but others are not (from what I can tell). Please look at my redacted Inputs.conf (below) and let me know if I have made an error in this file. If everything looks fine, I would appreciate any debugging advice.
Thanks

[default]
host = 

[monitor://D:\kiwilog\x.x.x.x]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0


[monitor://D:\kiwilog\y.y.y.y]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0

[monitor://D:\kiwilog\a.a.a.a]
whitelist=\*.csv$
connection_host=ip
sourcetype=synology:nas
index=nas
disabled=0

[monitor://D:\kiwilog\b.b.b.b]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\c.c.c.c]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\d.d.d.d]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0
0 Karma
1 Solution

fdarrigo
Path Finder

the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected

View solution in original post

fdarrigo
Path Finder

the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...