Deployment Architecture

File not indexing


Hi Team,

I have an issue when i try to index one file (this one in picture)

alt text

My input file is like this :

sourcetype = progress:inter
index = progress
crcSalt =
disabled = false

sourcetype = progress:contlive
index = progress
disabled = false

the sourcetype progress:inter have been successful created in a specific TA and deploy on all my server

All the files are indexed but not jobStatus.log

I already try to remove in my imput jobstatus.log and try to catch *.log in my source type progress:contlive but this file was not indexed also.

In splunkd.log on the UF i can see this

11-08-2018 15:36:26.387 +0100 INFO WatchedFile - Will begin reading at offset=5797312 for file='D:\eo\contLive\logs\jobStatus.log'.

But also not indexed

Can you help me ?

Many Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...