After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file?

[smanda]

I removed a monitor on one log file from all the Splunk forwarders in the inputs.conf file and restarted Splunk forwarder and Splunk indexers. However, we still see the new logs been indexed and search results returned.

[ddrillic]

What is the btool telling on the forwarders?

 ./splunk cmd btool inputs list monitor

Is it listing the removed files?

[smanda]

Output of the command is not listing the removed files.

[ddrillic]

And you see fresh data from this particular host on which you ran the btool command, right? Doesn't make any sense.

Anybody has any idea?

[smanda]

Yes. Its showing the monitors which we configured in inputs.conf right now.