topic Re: Forwarder is not forwarding all the files in directory. in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-not-forwarding-all-the-files-in-directory/m-p/59798#M11802 <P>Hard to guess what the problem could be since a part got forwarded though!</P> <P>Can you investigate following:</P> <UL> <LI>in the directory you're monitoring: create a new "dummy" file wich consist eg. "Hello World" (does that work - is it being indexed - can you see it on the receiver box)</LI> <LI>modify one of the existing file with a new entry</LI> <LI>check splunkd.log</LI> <LI>netstat -a (although that should work <span class="lia-unicode-emoji" title=":winking_face:">😉</span> )</LI> </UL> Thu, 17 Mar 2011 02:45:28 GMT LCM 2011-03-17T02:45:28Z Forwarder is not forwarding all the files in directory. https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-not-forwarding-all-the-files-in-directory/m-p/59797#M11801 <P>I have configured a forwarder on Linux and receiver on different Linux box.</P> <P>After restarting the forwarder I can see only the latest file got forwarded and on receiver only one file is indexed.</P> <P>However I can see on forwarder there are multiple files got indexed. The data input for forwarder is "monitor file and directory" with the path of logs directory.</P> <P>This logs directory has multiple log files.</P> <P>Please let me know why forwarder is not forwarding all the files.</P> Wed, 16 Mar 2011 02:08:59 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-not-forwarding-all-the-files-in-directory/m-p/59797#M11801 kmisaal 2011-03-16T02:08:59Z Re: Forwarder is not forwarding all the files in directory. https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-not-forwarding-all-the-files-in-directory/m-p/59798#M11802 <P>Hard to guess what the problem could be since a part got forwarded though!</P> <P>Can you investigate following:</P> <UL> <LI>in the directory you're monitoring: create a new "dummy" file wich consist eg. "Hello World" (does that work - is it being indexed - can you see it on the receiver box)</LI> <LI>modify one of the existing file with a new entry</LI> <LI>check splunkd.log</LI> <LI>netstat -a (although that should work <span class="lia-unicode-emoji" title=":winking_face:">😉</span> )</LI> </UL> Thu, 17 Mar 2011 02:45:28 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-not-forwarding-all-the-files-in-directory/m-p/59798#M11802 LCM 2011-03-17T02:45:28Z