Getting Data In

Why isn't the universal forwarder processing all the monitor stanzas in inputs.conf for multiple folders on a Kiwi syslog server?

Path Finder

Newbie question - I have an inputs.conf which is configured to monitor multiple folders on a Kiwi syslog server. Every host logging to Kiwi writes a CSV to a separate folder based on the remote device's IP. For example, device "a.a.a.a" writes to d:\kiwilog\a.a.a.a

Some stanzas are being processed (I can see the data in Splunk), but others are not (from what I can tell). Please look at my redacted Inputs.conf (below) and let me know if I have made an error in this file. If everything looks fine, I would appreciate any debugging advice.
Thanks

[default]
host = 

[monitor://D:\kiwilog\x.x.x.x]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0


[monitor://D:\kiwilog\y.y.y.y]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0

[monitor://D:\kiwilog\a.a.a.a]
whitelist=\*.csv$
connection_host=ip
sourcetype=synology:nas
index=nas
disabled=0

[monitor://D:\kiwilog\b.b.b.b]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\c.c.c.c]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\d.d.d.d]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0
0 Karma
1 Solution

Path Finder

the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected

View solution in original post

Path Finder

the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected

View solution in original post