Getting Data In

How to reindex the same source

vkakani60
Path Finder

I tried to reindex the following windows directories using "Monitor" from input data.

d:\logs\appx
d:\logs\appy
d:\logs\trac

the above folders contain 3-4 log files.
I gave specific sourcetype for each data input folder.

Splunk indexed "appx" and "trac" folders but not "appy" folder. I am unable to see the events from the search results for appy, but I can see Splunk showed count of appy directory under files & directories. I deleted the datainputs and sourcetype and added appy with different sourcetype and index but still I can't see the events in the search results.

I tried to add crcsalt but I don't have permission to edit the input.conf file.

How can I reindex the appy directory

NOTE: Splunk indexing files under appy individually but not entire appy directory.

0 Karma

ddrillic
Ultra Champion

Is it possible for you to run the following on the forwarder ./splunk cmd btool inputs list monitor?

0 Karma

vkakani60
Path Finder

I am not fetching data from remote servers to run that forwarder command.

Those directories are on splunk local server. (I mean that "appy" directory is located on D drive and splunk installed on C drive) no other servers connected using universal forwarder..

0 Karma

vkakani60
Path Finder

I can index the individual file under that appy directory but not entire appy directory. Wondering why its not indexing because the logs in appy are similar to other folder logs but different application.

0 Karma

sundareshr
Legend

What timerange are you searching? Have you tried alltime?

0 Karma

vkakani60
Path Finder

I am searching for "all time" only . Interesting thing is it is indexing individual files but not that directory.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...