topic Re: After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234049#M45606 <P>Output of the command is not listing the removed files.</P> Wed, 05 Oct 2016 23:27:16 GMT smanda 2016-10-05T23:27:16Z After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file? https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234047#M45604 <P>I removed a monitor on one log file from all the Splunk forwarders in the inputs.conf file and restarted Splunk forwarder and Splunk indexers. However, we still see the new logs been indexed and search results returned.</P> Wed, 05 Oct 2016 19:35:24 GMT https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234047#M45604 smanda 2016-10-05T19:35:24Z Re: After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file? https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234048#M45605 <P>What is the <CODE>btool</CODE> telling on the forwarders?</P> <PRE><CODE> ./splunk cmd btool inputs list monitor </CODE></PRE> <P>Is it listing the <STRONG>removed</STRONG> files?</P> Wed, 05 Oct 2016 22:32:53 GMT https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234048#M45605 ddrillic 2016-10-05T22:32:53Z Re: After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file? https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234049#M45606 <P>Output of the command is not listing the removed files.</P> Wed, 05 Oct 2016 23:27:16 GMT https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234049#M45606 smanda 2016-10-05T23:27:16Z Re: After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file? https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234050#M45607 <P>And you see fresh data from this particular host on which you ran the <CODE>btool</CODE> command, right? Doesn't make any sense.</P> <P>Anybody has any idea?</P> Thu, 06 Oct 2016 15:41:45 GMT https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234050#M45607 ddrillic 2016-10-06T15:41:45Z Re: After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file? https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234051#M45608 <P>Yes. Its showing the monitors which we configured in inputs.conf right now.</P> Thu, 06 Oct 2016 17:13:16 GMT https://community.splunk.com/t5/Getting-Data-In/After-removing-a-monitor-on-one-log-file-from-all-my-Splunk/m-p/234051#M45608 smanda 2016-10-06T17:13:16Z