https://community.splunk.com/t5/Getting-Data-In/Forwarder-Issue/m-p/69460#M14084 <P>There are log files in a directory and all of them were forwarded to indexer except the files starting with SystemOut* and intrestingly it got forwarded till couple of days back ( last indexed was on Feb 7th).<BR /> Tried with this option, but no use<BR /> crcSalt = <SOURCE></SOURCE></P> <P>Logs have this message..</P> <P>02-09-2012 20:15:53.256 -0500 INFO BatchReader - Removed from queue file='/opt/log/websphere/appserverlogs/WESB/SystemOut.log'.</P> <P>Any help is appreciated</P> Fri, 10 Feb 2012 10:03:30 GMT Ferrari 2012-02-10T10:03:30Z https://community.splunk.com/t5/Getting-Data-In/Forwarder-Issue/m-p/69460#M14084 <P>There are log files in a directory and all of them were forwarded to indexer except the files starting with SystemOut* and intrestingly it got forwarded till couple of days back ( last indexed was on Feb 7th).<BR /> Tried with this option, but no use<BR /> crcSalt = <SOURCE></SOURCE></P> <P>Logs have this message..</P> <P>02-09-2012 20:15:53.256 -0500 INFO BatchReader - Removed from queue file='/opt/log/websphere/appserverlogs/WESB/SystemOut.log'.</P> <P>Any help is appreciated</P> Fri, 10 Feb 2012 10:03:30 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-Issue/m-p/69460#M14084 Ferrari 2012-02-10T10:03:30Z https://community.splunk.com/t5/Getting-Data-In/Forwarder-Issue/m-p/69461#M14085 <P>Hi Ferrari</P> <P>you can find a lot of good tips about this topic in this answer <A href="http://splunk-base.splunk.com/answers/31147/universal-forwarder-only-sending-2-logs">here</A></P> <P>cheers</P> Fri, 10 Feb 2012 10:43:34 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-Issue/m-p/69461#M14085 MuS 2012-02-10T10:43:34Z