Splunk Search

Parsing custom log names into different indexes. Same folder.


My question has to deal with regex and the inputs.conf. It's new to me so I'm taking it slow. We have all of our custom app logs dumped into a '//inHouseLogs/' folder on our servers. Right now I'm attempting to split these logs into indexes for each program. Basically the file structure in the folder looks like this:



And here is how I have the inputs.conf on the universal forwarder (\\SplunkUniversalForwarder\etc\system\local) setup for it:

host = server001

disabled = false
sourcetype = programOne_logs
index = programOne

disabled = false
sourcetype = programTwo_logs
index = programTwo

disabled = 0
start_from = newest
index = system

disabled = 0
current_only = 1
index = system


Does this good or am I doing something wrong? Also should I be editing the indexes.conf in \etc\system\local in or \etc\apps\search\local

0 Karma

Splunk Employee
Splunk Employee

The regexes on the monitor header may not do what you want to do. The asterisk (*) matches anything in a single path segment while "..." will recurse through directories.

I think you'd be better off using whitelist and blacklist under your monitor stanzas.

Check here for more info on white/blacklisting: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!