Getting Data In

Index monitoring issues

Motivator

Hi,

My instance of Splunk is monitoring a server log file that is updated at periods throughout the day. Splunk has indexed the data from this log file however, the new data that has gone into the log file today has not been indexed by Splunk. (Splunk is still monitoring this file) Any reasons why this is the case?

I am using Windows, the server is also using Windows. I am monitoring a .txt file that is updated at times during the day. I am using Splunk v4.1.3

0 Karma
1 Solution

Super Champion
0 Karma

Motivator

Why is this missing file size, file position, and type tags?

0 Karma

Motivator

Splunk is able to see all of the events in this .txt file up to last Friday. Since then, today more data has been entered into the .txt file but Splunk has not indexed that data.

0 Karma

Super Champion
0 Karma

Motivator

This helped me to reach an answer so thank you very much.

0 Karma

Super Champion

Please update your question with some additional information: What version of splunk are you using, which OS, and what application are you monitoring (some Windows apps are known to cause problems like this because of how they write to the log file.)

0 Karma