Security

error while giving path for different servers

rupesh212121
Explorer

hi my scenario is i am having different servers in which same services are running like httpd, maillog, errorlog and i want to see logs of all these servers. i have tried to give path for both the servers for seeing it access logs as /var/logs/httpd/access_logs and it gave me the following error.

"Encountered the following error while trying to save: In handler 'monitor': Cannot create another input with the name "/var/log/httpd/access_log", one already exists."

how can i see the same logs of two different servers.

plz help me in this regard.

thank u Prakash

Tags (1)
0 Karma

LCM
Contributor

Basically, you do:

Server 1 (Indexer - MASTER)

  1. Manager » Data inputs » Files & Directories » Add New --> */var/log/httpd/access_log*
  2. Manager » Forwarding and receiving » Receive data » Add New --> 9997

Server 2 (Forwarder - CLIENT)

  1. Manager » Data inputs » Files & Directories » Add New --> */var/log/httpd/access_log*
  2. Manager » Forwarding and receiving » Forward data » Add New --> < ip.from.your.master:9997 >

Please, read through following docs as well:

LCM
Contributor

That error means you already configured that path for monitoring then. There is no reason to configure it twice. Can you double check, if you entered that path before

rupesh212121
Explorer

but it is not accepting the path as it is saying the path already exist.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...