Getting Data In

inputs.conf forwarding from the same directory issue

Builder

Only the first Stanza works, when I comment out one of them, it works fine, but no matter what happens, I cant get them both to work...

Only highlighted logs are forwarded.

# logs1
[monitor:///home/mmm/logs/mmm.log*]
sourcetype = Core
index = CoreLog
_TCP_ROUTING = umm
#recursive = false
#whitelist = mmm\.log(\.1)?

# logs2
[monitor:///home/mmm/logs/mmm/smmm.log*]
sourcetype = CoreSMS
index = CoreLog
_TCP_ROUTING = umm
whitelist = smmm\.log(\.\d+\-\d+\-\d+)?
0 Karma

Builder

Have you tried like this:

# logs1
[monitor:///home/mmm/logs/mmm.log*]
sourcetype = Core
index = CoreLog
_TCP_ROUTING = umm
recursive = false

# logs2
[monitor:///home/mmm/logs/mmm/smmm.log*]
sourcetype = CoreSMS
index = CoreLog
_TCP_ROUTING = umm
recursive = false

Also, does your SUF shows any error message in the logs?

0 Karma

Builder
0 Karma

Builder

Sorry, I have tried the above on multiple instances, but the same issue remains....

Could this be due to the fact that #log2 stanza is pointing at a Sub directory as opposed to the #log1 stanza which is one directory above it??

0 Karma

Builder

Splunk Universal Forwarder. I imagine tei config you pasted there in not from the inputs.conf on the Splunk Server but from some other box running a forwarder (splunk agent)

0 Karma

Builder

Whats a SUF?

0 Karma