Splunk Enterprise Security

inputs.conf

phanichintha
Path Finder

Hello,

In one of the windows machine logs (path: C:\servicedesk\logs) sending via the universal forwarder to Splunk. So I created inputs.conf and below are the monitor paths, so now am getting logs from sourcetype=%sit% but no logs are coming from sourcetype=automation. Why logs are not coming under sourcetype=automation.

[monitor://C:\servicedesk\logs]
disabled = 0
index = main
sourcetype = %sit%

[monitor://C:\servicedesk\logs]
disabled = 0
index = main
sourcetype = automation

Labels (1)
Tags (1)
0 Karma
1 Solution

phanichintha
Path Finder

HI,

 

there is no difference in both stanzas, both are same logs, but here am i created for the first time sourcetype=%sit% am getting logs after i changes to sourcetype=Automation and disabled sourcetype=%sit% am not getting logs, so now i want logs will be index only with sourcetype=Automation

View solution in original post

0 Karma

rnowitzki
Builder

Hi  @phanichintha ,

You definifed the same path in 2 different stanzas.
What is the difference in the events/logs between sourcetypes "%sti%" and "automation"?

BR
Ralph


--
Karma and/or Solution tagging appreciated.
0 Karma

phanichintha
Path Finder

HI,

 

there is no difference in both stanzas, both are same logs, but here am i created for the first time sourcetype=%sit% am getting logs after i changes to sourcetype=Automation and disabled sourcetype=%sit% am not getting logs, so now i want logs will be index only with sourcetype=Automation

0 Karma

phanichintha
Path Finder

HI, after i set for only one stanza i got my results, problem solved.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...