Getting Data In

Splunk Missing Indexed Content Files From FTP Server

mathiasy123
Path Finder

Greetings,

I have a problem with my Splunk index. My Splunk indexed data from a file log in FTP Server using FTP Pull Add-On.

But the problem is, there is missing file content that my Splunk index did not index.

For example:

file_name.log has some 6 content (6 rows data)

But my Splunk did not index all of 6 content on that file, resulting only 5 content (5 rows data) indexed. So, in my Splunk, there are 5 events produced.

 

My question is:

1. How to track my Splunk index, when indexing the data with all details, like the file content, the time-indexed, and etc? 

2. How to fix my Splunk index miss some of the file content when the index happens?

 

Thanks in advanced

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...