Getting Data In

Monitoring Input Returned only one file

rajindurbal
Path Finder

So I am monitoring a folder for all of the files in the folder on a splunk universal forwarder. In the SplunkUniversalforwarder/etc/system/local the config is:

[monitor://*.csv]
disabled = 0
index = abc
sourcetype = abc_sourcetype
ignoreOlderThan = 14d

So far I am only getting one file from the folder, when there are about 20. What do I need to do to fix this?

0 Karma

kichojiran
New Member

Try it after delete "ignoreOlderThan = 14d"

OR Check if the files are 14 days old.

0 Karma

rajindurbal
Path Finder

@kichojiran Thank you for the response. I tried removing it to see if that made a difference. All of the files in the folder are from the past 12 hours. It did not seem to fix the issue.

0 Karma

kichojiran
New Member

Nothing unusual about the splunkd.log contents?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>