So I am monitoring a folder for all of the files in the folder on a splunk universal forwarder. In the SplunkUniversalforwarder/etc/system/local the config is:
disabled = 0
index = abc
sourcetype = abc_sourcetype
ignoreOlderThan = 14d
So far I am only getting one file from the folder, when there are about 20. What do I need to do to fix this?
Try it after delete "ignoreOlderThan = 14d"
OR Check if the files are 14 days old.
@kichojiran Thank you for the response. I tried removing it to see if that made a difference. All of the files in the folder are from the past 12 hours. It did not seem to fix the issue.
Nothing unusual about the splunkd.log contents?