Nested inputs (Splunk 4.1)

[Simon]

Hi folks

I have a directory structure on my server box (with splunk LWF) like this:

/foo/bar/node1/server1/SystemOut.log
/foo/bar/node1/server1/SystemErr.log
/foo/bar/node1/server1/appa.log
/foo/bar/node1/server1/appb.log
/foo/bar/node1/server2/SystemOut.log
/foo/bar/node1/server2/SystemErr.log
/foo/bar/node1/server2/appa.log
/foo/bar/node1/server2/appb.log
/foo/bar/node1/server2/wu_adapter.log

In my splunk LWF I just monitor /foo/bar and using white- and blacklists so I only get the logs I need. The reason why I'm just monitoring /foo/bar is, that I have quiet plenty of nodes where my LWF is running on and so I only need just 1 serverclass to monitor all my logs. If I should use more specific input configs, I have to create about 50 serverclasses...

Now my problem is that just for one logfile (wu_adapter.log) I need special settings in props.conf, like timestamp prefix or other transforms orders. Is there a proper way to use nested monitor stanzas? Actually splunk does not work with something like that:

[monitor:///foo/bar]
[monitor:///foo/bar/.../.../wu_*.log]

What do you suggest?

Thanks Simon

[BunnyHop · Accepted solution]

You can solve this by assigning a higher priority on [monitor:///foo/bar/.../.../wu_*.log]

Please see this: http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Attributeprecedencewithinafile

and go to section "Attribute precedence within a single file"

[gkanapathy · Accepted solution]

Here is an example:

inputs.conf:

[monitor:///foo/bar]

props.conf:

[source::/foo/bar/.../wu_*adapter.log]
sourcetype = xxx
priority = 200
#higher priority wins

[source::/foo/bar/...]
sourcetype = zzz
priority = 100

[BunnyHop · Accepted solution]

You can solve this by assigning a higher priority on [monitor:///foo/bar/.../.../wu_*.log]

Please see this: http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Attributeprecedencewithinafile

and go to section "Attribute precedence within a single file"

[Simon]

Yeah, thanks! That was the key...