Newbie question - I have an inputs.conf which is configured to monitor multiple folders on a Kiwi syslog server. Every host logging to Kiwi writes a CSV to a separate folder based on the remote device's IP. For example, device "a.a.a.a" writes to d:\kiwilog\a.a.a.a
Some stanzas are being processed (I can see the data in Splunk), but others are not (from what I can tell). Please look at my redacted Inputs.conf (below) and let me know if I have made an error in this file. If everything looks fine, I would appreciate any debugging advice.
Thanks
[default]
host =
[monitor://D:\kiwilog\x.x.x.x]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0
[monitor://D:\kiwilog\y.y.y.y]
whitelist=\.csv$
connection_host=ip
sourcetype=cisco:asa
disabled=0
[monitor://D:\kiwilog\a.a.a.a]
whitelist=\*.csv$
connection_host=ip
sourcetype=synology:nas
index=nas
disabled=0
[monitor://D:\kiwilog\b.b.b.b]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0
[monitor://D:\kiwilog\c.c.c.c]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0
[monitor://D:\kiwilog\d.d.d.d]
whitelist=\*.csv$
connection_host=ip
sourcetype=cisco:ios
index=vgw
disabled=0
the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected
the problem turned out to be the whitelist expression. By removing this, the UF started processing the files as expected