Hi,
After I restart splunk, Log files doesn't get indexed.
Any idea how can I overcome this issue?
I tried,
splunk restart
splunk stop splunkd -> start again
on splunk-server:8089/services/admin/inputstatus/
that file status : batch processing
Thanks
Splunk takes a little while to spin up after a restart, how long are you waiting for these logs to show up after a restart?
Also depending on how you have the input set up, you could potentially speed up the process.
If you have
[monitor:/var/log/*]
Splunk will (on restart) iterate through the entire /var/log/ directory, listing all files in the directory and all subdirectories, then it will begin traversing down a directory level and on and on until it has finished. Then it will start indexing the files.