Index monitoring issues

[Ant1D]

Hi,

My instance of Splunk is monitoring a server log file that is updated at periods throughout the day. Splunk has indexed the data from this log file however, the new data that has gone into the log file today has not been indexed by Splunk. (Splunk is still monitoring this file) Any reasons why this is the case?

I am using Windows, the server is also using Windows. I am monitoring a .txt file that is updated at times during the day. I am using Splunk v4.1.3

[Ant1D]

• \...\c$\Temp/s:key /s:dict /s:key

Why is this missing file size, file position, and type tags?

[Ant1D]

Splunk is able to see all of the events in this .txt file up to last Friday. Since then, today more data has been entered into the .txt file but Splunk has not indexed that data.

[Lowell · Accepted solution]

There are some additional troubleshooting techniques outlined here:

http://answers.splunk.com/questions/6198/what-is-isnt-getting-monitored-and-why

[Ant1D]

This helped me to reach an answer so thank you very much.

[Lowell]

Please update your question with some additional information: What version of splunk are you using, which OS, and what application are you monitoring (some Windows apps are known to cause problems like this because of how they write to the log file.)