Hi guys!
How can I look at indexing process? Can I see what splunk is indexing file by file. Because it looks like black box, I show source and then search index but don't understand how splunk will index new files.
Hi,
you have some options. If you want to know which files splunk processes, you can for example take a look at the Trailing processor:
https://localhost:8089/services/admin/inputstatus/TailingProcessor%3AFileStatus
To check the performance of the indexing queues you can use the distributed management console. In the splunk webui go to settings > distributed management console > indexing performance.
To get a better understanding of the indexing process, take a look at the docs. For example here: Link
Greetings
Tom