Getting Data In

inputs.conf forwarding from the same directory issue

Dark_Ichigo
Builder

Only the first Stanza works, when I comment out one of them, it works fine, but no matter what happens, I cant get them both to work...

Only highlighted logs are forwarded.

# logs1
[monitor:///home/mmm/logs/mmm.log*]
sourcetype = Core
index = CoreLog
_TCP_ROUTING = umm
#recursive = false
#whitelist = mmm\.log(\.1)?

# logs2
[monitor:///home/mmm/logs/mmm/smmm.log*]
sourcetype = CoreSMS
index = CoreLog
_TCP_ROUTING = umm
whitelist = smmm\.log(\.\d+\-\d+\-\d+)?
0 Karma

musskopf
Builder

Have you tried like this:

# logs1
[monitor:///home/mmm/logs/mmm.log*]
sourcetype = Core
index = CoreLog
_TCP_ROUTING = umm
recursive = false

# logs2
[monitor:///home/mmm/logs/mmm/smmm.log*]
sourcetype = CoreSMS
index = CoreLog
_TCP_ROUTING = umm
recursive = false

Also, does your SUF shows any error message in the logs?

0 Karma

musskopf
Builder
0 Karma

Dark_Ichigo
Builder

Sorry, I have tried the above on multiple instances, but the same issue remains....

Could this be due to the fact that #log2 stanza is pointing at a Sub directory as opposed to the #log1 stanza which is one directory above it??

0 Karma

musskopf
Builder

Splunk Universal Forwarder. I imagine tei config you pasted there in not from the inputs.conf on the Splunk Server but from some other box running a forwarder (splunk agent)

0 Karma

Dark_Ichigo
Builder

Whats a SUF?

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...