How to edit my forwarder configuration to monitor multiple log files to send to multiple indexes?

[bzhsteven]

I have a forwarder which I want to send multiple monitoring to multiple indexes. In example so:

[monitor:///var/log/apache2/.log]
index=web

[monitor:///var/log/mail.log*]
index=mail

The problem I am having is that the forwarder seems to not send anything anymore as long as I have more than one [monitor:// ...

I made manually the setup into the /opt/splunkforwarder/etc/system/local/inputs.conf and restarted the splunk forwarder.

any clue where I could look to solve this? Tx in advance.

[aakwah]

May be because sourcetype is missing, try the following:

[monitor:///var/log/apache2/.log]
index=web
sourcetype = web

[monitor:///var/log/mail.log*]
index=mail
sourcetype = mail

If it is still not working please check splunkd.log for any errors,

tail -f /opt/splunkforwarder/var/log/splunk/splunkd.log

Regards,