cookbooks/mu-tools/files/default/splunk-apps/base_logs_unix/local/inputs.conf
[monitor:///var/log/messages]
disabled = false
followTail = 0
[monitor:///var/log/httpd/access_log]
disabled = false
followTail = 0
sourcetype = access_combined
[monitor:///var/log/httpd/error_log]
disabled = false
followTail = 0
sourcetype = apache_error