What is the precedence? or will it creat problems if I am monitoring All files in directory and also monitor a specific file in that dir.
[monitor:///log/new/local6]
sourcetype=syslog_local6
[monitor:///log]
followTail=0
ignoreOlderThan=1d
recurse=true
sourcetype=syslog
Specify a blacklist entry in the generic stanza. Apart from what splunk would do, this makes it much more obvious to others trying to understand how your configuration works.
Specify a blacklist entry in the generic stanza. Apart from what splunk would do, this makes it much more obvious to others trying to understand how your configuration works.