whitelist two different sourcetype under same monitoring path

[lain179]

Hi,

I have two different log types under the same directory path. At first I have only imported one type of log:

[monitor://PATH]
disabled = 0
followTail = false
host = HOST1
sourcetype = A Logs
ignoreOlderThan = 2d
whitelist = A.*.log
crcSalt = <SOURCE>
blacklist = native|\.zip

.... the log lines are imported fine to Splunk. AND THEN a few weeks later I added second type of log which is under the same path ....

[monitor://PATH]
disabled = 0
followTail = false
host = HOST1
sourcetype = B Logs
ignoreOlderThan = 2d
whitelist = B.*.log
crcSalt = <SOURCE>
blacklist = native|\.zip

Now, Splunk is NOT getting any A Logs, but it has everything from B Logs.

Did I do something wrong? How can I get both types imported to Splunk?

Thanks!

[martin_mueller · Accepted solution]

When you have two stanzas with the same name you actually only have one stanza specified in two locations, with later values overwriting earlier values. As a result, your B.*.log whitelist prevails.

Consider moving the whitelist into the name of the stanza, then you can have two different configurations. Something like monitor://PATH/A*.log and monitor://PATH/B*.log should work.

[lain179]

That worked. Thanks!