I have a forwarder which I want to send multiple monitoring to multiple indexes. In example so:
[monitor:///var/log/apache2/.log]
index=web
[monitor:///var/log/mail.log*]
index=mail
The problem I am having is that the forwarder seems to not send anything anymore as long as I have more than one [monitor:// ...
I made manually the setup into the /opt/splunkforwarder/etc/system/local/inputs.conf and restarted the splunk forwarder.
any clue where I could look to solve this? Tx in advance.
... View more