File monitoring not working after re-enabling

[remy06]

I have been monitoring a log file via file monitor input.I disabled the monitoring temporary for a few days but when I switched it back today,when I did a search it only showed me the latest event which was the time I stopped the monitoring few days ago.

However,on the search summary page itself,the Last Update is indicated as today,so as the same as the log file itself.

[jbsplunk]

Maybe you've got some kind of a timestamp issue? What does your search look like? If you were to generate some new lines into this file and set the search to do only a search on the source w/ an all time, real time search, do you see events? What you describe makes me think this might be what you are observing, and that the time constraints of the search are masking the events. You can also try searching for some unique string over all time.

[remy06]

the file that i'm monitoring is still being updated with events however splunk is not able to index the new events.

[remy06]

The search is source="/path/file.log" on all time.