monitoring syslogd - not indexing multiple "local" folders

[Runals]

All - any help would be appreciated on this!

I've installed a universal forwarder onto a system that has an older version of syslog. While not optimal from a Splunk log categorization perspective the files created look basically like this:

auth
authpriv
cron
daemon
...
local0
local1
local2
...
syslog

From the inputs.conf file I had I was getting all of those except when it hit the "local" files - it was just grabbing local0. So from the list above it was getting everything before local0, local0, then skipping the rest of the "locals" and moving down to whatever was next. The problem of course is I need to get all. I then modified the inputs file to blacklist the local folders and call them out specifically.

[monitor:///home/repo10/r0/log13/...]
blacklist = local*
sourcetype = syslog
disabled = false

[monitor:///home/repo10/r0/log13/local*]
sourcetype = syslog
disabled = false

This still only brings in local0. I then took it a step further and called out local0 and local7 in their own stanzas but it isn't grabbing 7.

Any thoughts? I'm guessing it is something minor.

[kristian_kolb]

Have you checked for errors in splunkd.log?
Have a look at the REST endpoint for your system:

https://computername:8089/admin/services/inputstatus/TailingProcessor:FileStatus

This should give you a listing of the files that Splunk are trying to read, and how it has succeeded in doing so.

Hope this helps,

Kristian