Getting Data In

Splunk Missing Indexed Content Files From FTP Server

Path Finder


I have a problem with my Splunk index. My Splunk indexed data from a file log in FTP Server using FTP Pull Add-On.

But the problem is, there is missing file content that my Splunk index did not index.

For example:

file_name.log has some 6 content (6 rows data)

But my Splunk did not index all of 6 content on that file, resulting only 5 content (5 rows data) indexed. So, in my Splunk, there are 5 events produced.


My question is:

1. How to track my Splunk index, when indexing the data with all details, like the file content, the time-indexed, and etc? 

2. How to fix my Splunk index miss some of the file content when the index happens?


Thanks in advanced

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!