Missing events from Splunk Universal Forwarder

[iancorrea]

I have one missing event out of 168 events from our Universal Forwarder. I've already checked the internal logs and the file has been indexed "Batch input finished reading file=", but I cannot find this source on my index. I also tried to expand time range and nothing appears, then check if the forwarder was restarted on the time of file was index, but it is not.

Settings on my forwarder is:

inputs.conf
[batch://my_path]
move_policy = sinkhole
disabled = false
sourcetype = my_sourcetype
index = my_index

outputs.conf
[tcpout]
defaultGroup = default-autolb-group-forwarder

[tcpout:default-autolb-group-forwarder]
disabled = false
server = myIndexer:9997
useACK = true

[nickhills]

Is this one event missing from a single log file?
(ie the log contains 168 events, and only 167 have been indexed)
Or is this one event from a batch of multiple files?

The reason I ask is that it could be that the missing event did not break properly and was either merged, or dropped.

If you still have the source log file, are you able to identify which event is missing, and does it appear "well formed" in the context of the other events?

[manjunathmeti]

Is there any extraction or parsing done on sourcetype 'my_sourcetype'?

[iancorrea]

yes, the other 167 events was successfully parsed

[manjunathmeti]

Since this is a small file, can you use monitor instead of batch and check?

[iancorrea]

I have been using batch since 1 month ago and there is no problem until this day. I cannot use the monitor because my client wants to use batch.