I have a forwarder which I want to send multiple monitoring to multiple indexes. In example so:
[monitor:///var/log/apache2/.log]
index=web
[monitor:///var/log/mail.log*]
index=mail
The problem I am having is that the forwarder seems to not send anything anymore as long as I have more than one [monitor:// ...
I made manually the setup into the /opt/splunkforwarder/etc/system/local/inputs.conf and restarted the splunk forwarder.
any clue where I could look to solve this? Tx in advance.
May be because sourcetype is missing, try the following:
[monitor:///var/log/apache2/.log]
index=web
sourcetype = web
[monitor:///var/log/mail.log*]
index=mail
sourcetype = mail
If it is still not working please check splunkd.log for any errors,
tail -f /opt/splunkforwarder/var/log/splunk/splunkd.log
Regards,