Hello splunkies! I'm trying to be and admin and I'm trying to add data manually to my inputs.conf,  please see my scenario: path: /logfiles/syslog/log.txt The output from a script that contacts an internal REST API. There are two kinds of requests in this file: 1 . http://localhost:8080/api/requests/xTraining.json API shows data from the non-production host and should be written to Index = API-NPTraining 2. http://localhost:8080/api/requests/Training.json api shows data from the production host and should be written to index = API-PTraining Both should use sourcetype ss:training Data in this file will rotate daily to log.txt.1020, log.txt.1021...etc   I have my stanzas like this #first stanza [monitor:///logfiles/syslog/log*.txt] disabled = 0  host = http://localhost:8080/api/requests/xTraining.json index = API-NPTraining sourcetype = ss:training   # second Stanza [monitor:///logfiles/syslog/log*.txt] disabled = 0  host = http://localhost:8080/api/requests/Training.json index = API-PTraining sourcetype = ss:training   What am I missing?  Am I wrong in something?  thank you.     ... View more

Hello splunkies! I'm trying to be and admin and I'm doing an exercise but I cannot find the way to configure my inputs.conf here the exercise: path:  /logfiles/syslog/training-nix01.txt This file will be updated continuously and will roll daily to training-nix01.1, training-nix01.1 etc Data from these files should be written to Index: Training Sourcetype: tp:tr    any ideas? ... View more