Old log files are not getting ingested into Splunk Cloud

[anandhalagarasa]

Hi Team,

We got an requirement to ingest the xyz.log from a client machine.

So i have created an app in the deployment master and deployed the same. The app has been successfully reached the client machine as well.

I have created an app and deployed the same on 8th Sep 2019 and the log file (xyz.log) has been lastly updated on 5th Sep 2019 in the client machine. Actually i believe the log file should be ingested into Splunk Cloud but here in this case its not getting ingested into Splunk Cloud.

So can i know what is the reason behind it and have enclosed my inputs.conf for reference. So kindly check and help on this.

[monitor:///abc/def/ijk/lmn/xyz.log]
sourcetype = pgr:stv
index = 123
disabled = 0

Kindly note the file has the splunk read permission and also in the internal logs it states that the configuration stanza as been parsed. The internal logs are reaching Splunk Cloud without any issues there is no connectivity issues as well.

But still i couldn't able to see the logs in Splunk Cloud.

[anandhalagarasa]

Kindly help on my request

[tkomatsubara_sp]

At least, you should check the message in the splunkd.log. What can you find?

[anandhalagarasa]

@tkomatsubara,

In splunkd.log the file is getting parsed refer below:

09-09-2019 05:20:30.415 -0500 INFO TailingProcessor - Parsing configuration stanza: monitor:///abc/def/ijk/lmn/xyz.log

But still the logs are not getting indexed. So can i know how Splunk works? Will it ingest old data as well.

[tkomatsubara_sp]

There must be some errors. Can you find?

[anandhalagarasa]

There are no errors at all. Am i missing anything in the stanza. And one thing can you confirm is splunk can index the old date data as well.

[anandhalagarasa]

can anyone kindly help on my query.

[anandhalagarasa]

should i need to modify the inputs.conf stanza to ingest the old date logs. And the log date is on 5th Sep only. All seems to be fine but something it happens at the background and hence we couldn't able to ingest those logs.

Is this how Splunk works? Is it wont be able to ingest the old data logs kindly confirm please.