https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303226#M57271 <P>Try running following on your forwarder instance. See if Splunk is monitoring all the files you've configured for monitoring (will prompt for admin credentials for that Splunk instance)</P> <PRE><CODE>$SPLUNK_HOME/bin/splunk list monitor </CODE></PRE> Wed, 21 Feb 2018 19:08:07 GMT somesoni2 2018-02-21T19:08:07Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303222#M57267 <P>Hi, lately we've been checking how many files our splunk is indexing, and we noticed that it "skips" some files... We checked by searching:</P> <PRE><CODE>index=our_index | stats dc(source) index = _internal group = per_so* series=*.ourfile | stats count </CODE></PRE> <P>And both ways we got the same results, which are not all the files we indexed.</P> Wed, 21 Feb 2018 16:44:55 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303222#M57267 eylonronen 2018-02-21T16:44:55Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303223#M57268 <P>A cheerful place to start at <A href="http://docs.splunk.com/Documentation/Splunk/7.0.2/Troubleshooting/Cantfinddata">I can't find my data!</A></P> Wed, 21 Feb 2018 16:55:39 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303223#M57268 ddrillic 2018-02-21T16:55:39Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303224#M57269 <P>Also, check internal logs from yoru forwarder(s) to see if there are any warnings/error for your files. ( <CODE>index=_itnernal sourcetype=splunkd host=yourFwd *filename.ext*</CODE> )</P> Wed, 21 Feb 2018 17:04:16 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303224#M57269 somesoni2 2018-02-21T17:04:16Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303225#M57270 <P>I've already looked there... Zero warnings or errors....<BR /> Also we've tried both monitor and batch input. Both had the same problem...</P> Wed, 21 Feb 2018 18:53:52 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303225#M57270 eylonronen 2018-02-21T18:53:52Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303226#M57271 <P>Try running following on your forwarder instance. See if Splunk is monitoring all the files you've configured for monitoring (will prompt for admin credentials for that Splunk instance)</P> <PRE><CODE>$SPLUNK_HOME/bin/splunk list monitor </CODE></PRE> Wed, 21 Feb 2018 19:08:07 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303226#M57271 somesoni2 2018-02-21T19:08:07Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303227#M57272 <P>Even if there are no errors/warnings, do you see any entry for your log file that's missing?</P> <PRE><CODE>index=_internal sourcetype=splunkd host=yourFwd adding watch </CODE></PRE> Wed, 21 Feb 2018 19:11:14 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303227#M57272 somesoni2 2018-02-21T19:11:14Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303228#M57273 <P>well the forwarder doesnt write log when it monitors, only with batch input for some reason. Today we indexed some logs, and we saw one of the files in the forwarders log, but we could not search it...<BR /> I wonder if it has something to do with the fact that we added a few indexers recently.<BR /> Is there something i should update in the search head when i add indexers?</P> Wed, 21 Feb 2018 19:17:38 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303228#M57273 eylonronen 2018-02-21T19:17:38Z https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303229#M57274 <P>I didn't find any help in this page....</P> Thu, 22 Feb 2018 06:19:49 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-splunk-not-indexing-all-the-data/m-p/303229#M57274 eylonronen 2018-02-22T06:19:49Z