I configured inputs.conf to monitor a directory. All the files in the directory were not ingested to Splunk. Some XML files are being missed. I don't see any errors in the _internal logs. Can you please let me know if I'm missing any property in my configuration file?
my sample inputs.conf
check your splunkd log in splunkhome/var/log/splunk/
if you are looking file abc.txt then
cat splunkd.log | grep -i "abc.txt"
you will get the error message if not you will see the following entry [addingwatcher] that means file has been watched you will soon see the file contents on your search head
there are some errors, you should have esomething like this:
[monitor://C:\directory\myfile.txt] index=test sourcetype=test1 disabled=0
remember that the first two slashes are fixed, in unix you have another one slash, instead in Windows you have the full path (with drive) of the files to monitor; you can also use *.
For more information see http://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain .