Hi Team,
I have an issue when i try to index one file (this one in picture)
My input file is like this :
[monitor://D:\eo\contLive\logs\job*.log]
sourcetype = progress:inter
index = progress
crcSalt =
disabled = false
[monitor://D:\eo\contLive\logs*.log]
sourcetype = progress:contlive
index = progress
disabled = false
the sourcetype progress:inter have been successful created in a specific TA and deploy on all my server
All the files are indexed but not jobStatus.log
I already try to remove in my imput jobstatus.log and try to catch *.log in my source type progress:contlive but this file was not indexed also.
In splunkd.log on the UF i can see this
11-08-2018 15:36:26.387 +0100 INFO WatchedFile - Will begin reading at offset=5797312 for file='D:\eo\contLive\logs\jobStatus.log'.
But also not indexed
Can you help me ?
Many Thanks
