Splunk_TA_nix local inputs.conf not allowing multiple indexes

[diptij]

I created a Splunk_TA_nix/local/inputs.conf.

I created 2 different indexes in indexes.conf.  And then I created an inputs.conf and monitored 2 directories with 2 different indexes with same sourcetype.

I put files in the directories.

But the 2nd index doesn't get data in.  

Help please

[anilchaithu]

@diptij 

Can you please share your monitor stanza? Did you check splund logs for any errors?

It should not depend the add-on. It only depends on

1) The user running splunk on the server must have read permissions to the directories.

2) monitor stanza should be error free

[diptij]

Thank-you Anil for responding.

I was ingesting too many files and the indexing/ingesting was taking a lot of time. 

I was looking at the output of 'splunk list inputstatus'  https://localhost:8089/services/admin/inputstatus to see what the status of the indexing was:  the file position showed as 0 and status as File was read.  So, it wasn't conclusive as to what was happening. 

[anilchaithu]

@diptij 

If its with the data volume, try to increase the throughput to 512kbps OR more (default is 256kbps) for debug purpose and see if this resolves. we went upto 4096kbps for one of the use case.

Is there any errors in the log messages?