topic Re: Monitoring Input Returned only one file in Getting Data In

Monitoring Input Returned only one file

rajindurbal — Wed, 09 Jan 2019 02:26:10 GMT

So I am monitoring a folder for all of the files in the folder on a splunk universal forwarder. In the SplunkUniversalforwarder/etc/system/local the config is:

[monitor://*.csv]
disabled = 0
index = abc
sourcetype = abc_sourcetype
ignoreOlderThan = 14d

So far I am only getting one file from the folder, when there are about 20. What do I need to do to fix this?

Re: Monitoring Input Returned only one file

kichojiran — Wed, 09 Jan 2019 02:54:33 GMT

Try it after delete "ignoreOlderThan = 14d"

OR Check if the files are 14 days old.

Re: Monitoring Input Returned only one file

rajindurbal — Wed, 09 Jan 2019 03:05:04 GMT

@kichojiran Thank you for the response. I tried removing it to see if that made a difference. All of the files in the folder are from the past 12 hours. It did not seem to fix the issue.

Re: Monitoring Input Returned only one file

kichojiran — Wed, 09 Jan 2019 08:52:15 GMT

Nothing unusual about the splunkd.log contents?