My instance of Splunk is monitoring a server log file that is updated at periods throughout the day. Splunk has indexed the data from this log file however, the new data that has gone into the log file today has not been indexed by Splunk. (Splunk is still monitoring this file) Any reasons why this is the case?
I am using Windows, the server is also using Windows. I am monitoring a .txt file that is updated at times during the day. I am using Splunk v4.1.3
Splunk is able to see all of the events in this .txt file up to last Friday. Since then, today more data has been entered into the .txt file but Splunk has not indexed that data.
Please update your question with some additional information: What version of splunk are you using, which OS, and what application are you monitoring (some Windows apps are known to cause problems like this because of how they write to the log file.)