https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-not-sending-data-to-Indexer/m-p/463507#M79971 <P>I am reading different logs from same source folder. But not all files are getting read, one stanza works other don't. <BR /> If i restart the UF, all stanzas work, but changed data is not capturing by one stanza. </P> <P>files i am planning to monitor are<BR /> performance_data.log<BR /> performance_data.log.1<BR /> performance_data.log.2<BR /> performance_data.log.3</P> <P>performance.log<BR /> performance.log.1<BR /> performance.log.2</P> <P>SystemOut.log</P> <P>my input.conf file and</P> <P>[default]<BR /> host = LOCALHOST</P> <P>[monitor://E:\Data\AppServer\A1\performance_data.lo*]<BR /> source=applogs<BR /> sourcetype=data_log<BR /> index=my_apps</P> <P>[monitor://E:\Data\AppServer\A1\performance.lo*]<BR /> source=applogs<BR /> sourcetype=perf_log<BR /> index=my_apps</P> <P>[monitor://E:\Data\logs\ImpaCT_A1\SystemOu*]<BR /> source=applogs<BR /> sourcetype=systemout_log<BR /> index=my_apps</P> <P>\performance_data.lo* and \SystemOu* stanzas working fine, but performance.lo* stanza not working. only sends data when i restart the UF. <BR /> Anything i am doing wrong here ? </P> Wed, 30 Sep 2020 04:49:03 GMT ssayyaparaju 2020-09-30T04:49:03Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-not-sending-data-to-Indexer/m-p/463507#M79971 <P>I am reading different logs from same source folder. But not all files are getting read, one stanza works other don't. <BR /> If i restart the UF, all stanzas work, but changed data is not capturing by one stanza. </P> <P>files i am planning to monitor are<BR /> performance_data.log<BR /> performance_data.log.1<BR /> performance_data.log.2<BR /> performance_data.log.3</P> <P>performance.log<BR /> performance.log.1<BR /> performance.log.2</P> <P>SystemOut.log</P> <P>my input.conf file and</P> <P>[default]<BR /> host = LOCALHOST</P> <P>[monitor://E:\Data\AppServer\A1\performance_data.lo*]<BR /> source=applogs<BR /> sourcetype=data_log<BR /> index=my_apps</P> <P>[monitor://E:\Data\AppServer\A1\performance.lo*]<BR /> source=applogs<BR /> sourcetype=perf_log<BR /> index=my_apps</P> <P>[monitor://E:\Data\logs\ImpaCT_A1\SystemOu*]<BR /> source=applogs<BR /> sourcetype=systemout_log<BR /> index=my_apps</P> <P>\performance_data.lo* and \SystemOu* stanzas working fine, but performance.lo* stanza not working. only sends data when i restart the UF. <BR /> Anything i am doing wrong here ? </P> Wed, 30 Sep 2020 04:49:03 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Universal-Forwarder-not-sending-data-to-Indexer/m-p/463507#M79971 ssayyaparaju 2020-09-30T04:49:03Z