The issue here is that you have overlapping monitor stanzas. The * in the source implicitly tells Splunk to monitor files in /home/gcaaxfer/data/ for both, resulting in the overlapping stanzas and only one of them being read. The recommended approach to solve this issue is to create one stanza in inputs.conf to read in both sets of files and also deploy a props.conf within the same add-on on the Forwarder to specify the sourcetype based on the source. As follows: inputs.conf: [monitor:///home/gcaaxfer/data] whitelist = (*NR*.csv | *ticket*.csv) host_segment = 3 index = my_index disabled = false props.conf: [source::.../*NR*.csv] sourcetype = request_nr [source::.../*ticket*.csv] sourcetype = request_ticket Now that you've assigned them to separate sourcetypes, you can easily update your props.conf on your Indexers and/or Heavy Forwarders to properly perform the separate time extractions. ... View more