Deployment Architecture

File not indexing


Hi Team,

I have an issue when i try to index one file (this one in picture)

alt text

My input file is like this :

sourcetype = progress:inter
index = progress
crcSalt =
disabled = false

sourcetype = progress:contlive
index = progress
disabled = false

the sourcetype progress:inter have been successful created in a specific TA and deploy on all my server

All the files are indexed but not jobStatus.log

I already try to remove in my imput jobstatus.log and try to catch *.log in my source type progress:contlive but this file was not indexed also.

In splunkd.log on the UF i can see this

11-08-2018 15:36:26.387 +0100 INFO WatchedFile - Will begin reading at offset=5797312 for file='D:\eo\contLive\logs\jobStatus.log'.

But also not indexed

Can you help me ?

Many Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...