Splunk Search

data input - path name is the same

borgy95
Path Finder

I have two type of files i am inputted into splunk.

Both reside at /var/data/proxy/isolde.2015060812.log or mimi.2015060515.log

I can easily use the whitelist field with a regex to specifically point out which file i want to take. I want to to take them as separate inputs so each one can be assigned a different host value to be searched against.

However when specifying the path a second time splunk returns an error: "path is the same and another input". So I edited inputs.conf manually to specify the path/sourcetype/host/whitelist regex. doing a ./splunk btool check returned no errors so i think it will work?

Does anyone have any experience with this kind of scenario? Can you comment on using inputs.conf as a valid way to workaround the splunk error?

0 Karma
1 Solution

woodcock
Esteemed Legend

It should work but if it doesn't, just create a soft link like this:

ln -fs /var/data/proxy/ /var/data/proxycopy

Then use this:

[monitor:///var/data/proxycopy/]
whilelist=other regex

View solution in original post

0 Karma

woodcock
Esteemed Legend

It should work but if it doesn't, just create a soft link like this:

ln -fs /var/data/proxy/ /var/data/proxycopy

Then use this:

[monitor:///var/data/proxycopy/]
whilelist=other regex
0 Karma

borgy95
Path Finder

It did work , however editing the conf file means there is no entry in the splunk web gui, so i've opted for the softlink approach.

thanks again WC

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...