We have a 3 index/3 search head cluster with master and deployment server.
I have a inputs.conf with
[monitor:L:\SampleServices\Debug\*]
disabled = false
index = sample_services
But we keep getting the -too_small and the -2, -3 appended to new sourcetypes
there are 15 diff files being monitored under the Debug\* I dont want to have to create a seperate stanza for every file they add ..
I just want it to make the sourcetype the name of the file.. not add anything on the end.
thanks
↧