https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238077#M46246 <P>I tried to reindex the following windows directories using "Monitor" from input data.</P> <P>d:\logs\appx<BR /> d:\logs\appy<BR /> d:\logs\trac</P> <P>the above folders contain 3-4 log files. <BR /> I gave specific sourcetype for each data input folder. </P> <P>Splunk indexed "appx" and "trac" folders but not "appy" folder. I am unable to see the events from the search results for appy, but I can see Splunk showed count of appy directory under files &amp; directories. I deleted the datainputs and sourcetype and added appy with different sourcetype and index but still I can't see the events in the search results.</P> <P>I tried to add crcsalt but I don't have permission to edit the input.conf file.</P> <P>How can I reindex the appy directory </P> <P>NOTE: Splunk indexing files under appy individually but not entire appy directory. </P> Tue, 05 Jul 2016 20:32:49 GMT vkakani60 2016-07-05T20:32:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238077#M46246 <P>I tried to reindex the following windows directories using "Monitor" from input data.</P> <P>d:\logs\appx<BR /> d:\logs\appy<BR /> d:\logs\trac</P> <P>the above folders contain 3-4 log files. <BR /> I gave specific sourcetype for each data input folder. </P> <P>Splunk indexed "appx" and "trac" folders but not "appy" folder. I am unable to see the events from the search results for appy, but I can see Splunk showed count of appy directory under files &amp; directories. I deleted the datainputs and sourcetype and added appy with different sourcetype and index but still I can't see the events in the search results.</P> <P>I tried to add crcsalt but I don't have permission to edit the input.conf file.</P> <P>How can I reindex the appy directory </P> <P>NOTE: Splunk indexing files under appy individually but not entire appy directory. </P> Tue, 05 Jul 2016 20:32:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238077#M46246 vkakani60 2016-07-05T20:32:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238078#M46247 <P>What timerange are you searching? Have you tried alltime?</P> Tue, 05 Jul 2016 23:52:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238078#M46247 sundareshr 2016-07-05T23:52:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238079#M46248 <P>I am searching for "all time" only . Interesting thing is it is indexing individual files but not that directory. </P> Tue, 05 Jul 2016 23:55:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238079#M46248 vkakani60 2016-07-05T23:55:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238080#M46249 <P>Is it possible for you to run the following on the forwarder <CODE>./splunk cmd btool inputs list monitor</CODE>?</P> Wed, 06 Jul 2016 00:47:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238080#M46249 ddrillic 2016-07-06T00:47:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238081#M46250 <P>I am not fetching data from remote servers to run that forwarder command. </P> <P>Those directories are on splunk local server. (I mean that "appy" directory is located on D drive and splunk installed on C drive) no other servers connected using universal forwarder.. </P> Wed, 06 Jul 2016 00:53:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238081#M46250 vkakani60 2016-07-06T00:53:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238082#M46251 <P>I can index the individual file under that appy directory but not entire appy directory. Wondering why its not indexing because the logs in appy are similar to other folder logs but different application. </P> Wed, 06 Jul 2016 00:55:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reindex-the-same-source/m-p/238082#M46251 vkakani60 2016-07-06T00:55:30Z