I added a directory to monitor, with whitelist = log$
Later after seeing a file I didn't want to include was also being written, I modified this whitelist = startup.log. The other file that doesn't match is still being read, even with the splunkd process being restarted twice.
Here's my current monitor stanza:
[monitor:///app/actional/logs]
whitelist=startup\.log$
sourcetype=actional_startup
index=temp_syslog
disabled = 0
If I look at the TailingProcessor via the REST api, it confirms that the other files are not matching the whitelist:
/app/actional/logs/ActionalIntermediary_20110927_083150_283.log
parent /app/actional/logs
type Did not match whitelist 'startup.log$'.
However, searching:
index=temp_syslog source=/app/actional/logs/* NOT source=/app/actional/logs/startup.log does return events from this host matching that ActionalIntermediary log that the TailingProcessor says does not match.
Ideas on what could be wrong?
I'd bet the events being returned are events that were indexed during the run with the incorrect whitelist - check the tailing status endpoint now for the ActionalIntermediary files...
I'd bet the events being returned are events that were indexed during the run with the incorrect whitelist - check the tailing status endpoint now for the ActionalIntermediary files...
Yep, I had used the "All-Time" when performing a |delete operation. So the data I was seeing later was there from before changing the whitelist.
Your whitelist and inputs.conf stanza seem legit. Are you sure that the events returned by the search were not indexed before the new whitelist came into effect?