Possible explanations for Index not being refreshed automatically?

[_dave_b]

Hi.

I created a new index with along with a fresh install on a Win7 system a few days ago. It should be pointing to some log files that are continuously being updated. When I first created it, everything looked fine. However, when I run a search today, I'm still being told by Splunk that the latest event is from the time when I initially set up the index. I thought the index was supposed to refresh automatically, so I am puzzled as to why it's not being updated. Does anybody have any pointers where to look to find out why this is happening?

Thanks

[woodcock]

You created a new Index or a new Input. Creating a new Index will not cause data to flow into it.

[jplumsdaine22]

The most likely issue, since the logfiles reside on your indexer, is that the input is not set correctly. Try this search

index=_internal sourcetype=splunkd NOT log_level=INFO

This is splunks internal log, and should tell you if there are any problems with the logfiles you are generating. Especially of interest are messages with the filenames of the logfiles you think you have set up, and messages with TailingProcessor in them. Also check the settings of your input and make sure that they are set correctly.

[_dave_b]

Thanks for your reply. I tried that search and it mostly had errors that look like this:
12-01-2015 15:26:24.792 -0500 WARN SearchResults - Corrupt csv header, 2 columns with the same name '__mv_deviceId' (col #14 and #1, #14 will be ignored)

For my input, I had set it to read a directory with a whitelist to include only the files I'm interested in. I just deleted my whitelist and my search is now pulling events from the most recent logfile, so that's good. I thought the whitelist was good, it looked like:

c:\program files\app\appserver\logs\*\communication\*.txt

Where the wildcards were covering for a datestamp

[jplumsdaine22]

Ah yes I think the whitelist stanza doesn't support backslashes in windows - so no files were getting indexed.

See http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Specifyinputpathswithwildcards and http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Whitelistorblacklistspecificincomingdata

You should be able to put the whitelist in the monitor part. EG:

[monitor://c:\program files\app\appserver\logs\*\communication\*.txt 

and drop the whitelist entry altogether