Forwarder is not forwarding all the files in directory.

[kmisaal]

I have configured a forwarder on Linux and receiver on different Linux box.

After restarting the forwarder I can see only the latest file got forwarded and on receiver only one file is indexed.

However I can see on forwarder there are multiple files got indexed. The data input for forwarder is "monitor file and directory" with the path of logs directory.

This logs directory has multiple log files.

Please let me know why forwarder is not forwarding all the files.

[LCM]

Hard to guess what the problem could be since a part got forwarded though!

Can you investigate following:

• in the directory you're monitoring: create a new "dummy" file wich consist eg. "Hello World" (does that work - is it being indexed - can you see it on the receiver box)
• modify one of the existing file with a new entry
• check splunkd.log
• netstat -a (although that should work 😉 )