Getting Data In

Data not ingested for only a few days

ishugupta
Path Finder

I am facing a weird issue ,A particular file has only been ingested for 4 days day even though we we have been receiving it for last 10 days .
I looked the configuration , inputs.conf and props.conf , they are unchanged and the data got ingested yesterday as well .
I have gone through the logs on the forwarder as well .
Can you please tell me where I can look for error on indexers , or can there be any potential issue that someone can point out?

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

If the new file that gets placed there is "too similar" to the prior version, Splunk will refuse to index it on the belief that it already has. By "too similar" I mean "if the first <default> 256 bytes are the same". This size can be updated (see initCrcLength in inputs.conf).

ishugupta
Path Finder

we keep on placing new file each day.
I researched more , I checked the log on the indexer license_usage.log , I can see the entry there...still I cant pull up the file on the console..

0 Karma

sowings
Splunk Employee
Splunk Employee

More information please:

Is ths new contents on the same filename (i.e. a complete replacement)?

Or is it continued additions to a single file? (i.e. same file growing larger day by day)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...