Getting Data In
Highlighted

Why isn't the universal forwarder processing all the monitor stanzas in inputs.conf for multiple folders on a Kiwi syslog server?

Path Finder

Newbie question - I have an inputs.conf which is configured to monitor multiple folders on a Kiwi syslog server. Every host logging to Kiwi writes a CSV to a separate folder based on the remote device's IP. For example, device "a.a.a.a" writes to d:\kiwilog\a.a.a.a

Some stanzas are being processed (I can see the data in Splunk), but others are not (from what I can tell). Please look at my redacted Inputs.conf (below) and let me know if I have made an error in this file. If everything looks fine, I would appreciate any debugging advice.
Thanks

[default]
host = 

[monitor://D:\kiwilog\x.x.x.x]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0


[monitor://D:\kiwilog\y.y.y.y]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0

[monitor://D:\kiwilog\a.a.a.a]
whitelist=\*.csv$
connection_host=ip
sourcetype=synology:nas
index=nas
disabled=0

[monitor://D:\kiwilog\b.b.b.b]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\c.c.c.c]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0

[monitor://D:\kiwilog\d.d.d.d]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0
0 Karma
Highlighted

Re: Why isn't the universal forwarder processing all the monitor stanzas in inputs.conf for multiple folders on a Kiwi syslog server?

Path Finder

the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected

View solution in original post