I faced an question about data cannot update to search head real time. i created serveral local app folder on one windows client. and part of monitor logs updates to search head real time. part of monitor log data disappears in search head suddenly and after several hours it updates data again and can find all data before. And i checked the log updated real time but not updated to splunk real-time.
i wrote inputs.conf like this:
[monitor://\XAWSCSPLUNK\MIPC_Ping*.csv]
index = mxa_mipc_ping
sourcetype = mipcpinglog
ignoreOlderThan = 7d
crcSalt =
[monitor://\xawmodapp01\ModTrace\ModAutoSpooler\Trace*.txt]
index = mxa_mes_mod
sourcetype = xawmodapp01log
ignoreOlderThan = 7d
crcSalt =
Anyone know what should i do for that all log can upload real-time?
