Getting Data In

Monitoring Input Returned only one file

rajindurbal
Path Finder

So I am monitoring a folder for all of the files in the folder on a splunk universal forwarder. In the SplunkUniversalforwarder/etc/system/local the config is:

[monitor://*.csv]
disabled = 0
index = abc
sourcetype = abc_sourcetype
ignoreOlderThan = 14d

So far I am only getting one file from the folder, when there are about 20. What do I need to do to fix this?

0 Karma

kichojiran
New Member

Try it after delete "ignoreOlderThan = 14d"

OR Check if the files are 14 days old.

0 Karma

rajindurbal
Path Finder

@kichojiran Thank you for the response. I tried removing it to see if that made a difference. All of the files in the folder are from the past 12 hours. It did not seem to fix the issue.

0 Karma

kichojiran
New Member

Nothing unusual about the splunkd.log contents?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...