Hi,
I have two different log types under the same directory path. At first I have only imported one type of log:
[monitor://PATH] disabled = 0 followTail = false host = HOST1 sourcetype = A Logs ignoreOlderThan = 2d whitelist = A.*.log crcSalt = <SOURCE> blacklist = native|\.zip
.... the log lines are imported fine to Splunk. AND THEN a few weeks later I added second type of log which is under the same path ....
[monitor://PATH] disabled = 0 followTail = false host = HOST1 sourcetype = B Logs ignoreOlderThan = 2d whitelist = B.*.log crcSalt = <SOURCE> blacklist = native|\.zip
Now, Splunk is NOT getting any A Logs, but it has everything from B Logs.
Did I do something wrong? How can I get both types imported to Splunk?
Thanks!
When you have two stanzas with the same name you actually only have one stanza specified in two locations, with later values overwriting earlier values. As a result, your B.*.log
whitelist prevails.
Consider moving the whitelist into the name of the stanza, then you can have two different configurations. Something like monitor://PATH/A*.log
and monitor://PATH/B*.log
should work.
When you have two stanzas with the same name you actually only have one stanza specified in two locations, with later values overwriting earlier values. As a result, your B.*.log
whitelist prevails.
Consider moving the whitelist into the name of the stanza, then you can have two different configurations. Something like monitor://PATH/A*.log
and monitor://PATH/B*.log
should work.
That worked. Thanks!