Splunk Missing Indexed Content Files From FTP Server

mathiasy123 — Fri, 11 Sep 2020 03:52:54 GMT

Greetings,

I have a problem with my Splunk index. My Splunk indexed data from a file log in FTP Server using FTP Pull Add-On.

But the problem is, there is missing file content that my Splunk index did not index.

For example:

file_name.log has some 6 content (6 rows data)

But my Splunk did not index all of 6 content on that file, resulting only 5 content (5 rows data) indexed. So, in my Splunk, there are 5 events produced.

My question is:

1. How to track my Splunk index, when indexing the data with all details, like the file content, the time-indexed, and etc?

2. How to fix my Splunk index miss some of the file content when the index happens?

Thanks in advanced

topic Splunk Missing Indexed Content Files From FTP Server in Getting Data In

Splunk Missing Indexed Content Files From FTP Server