Why are all the hosts not showing in Splunk after the new App deployment?

[davidcraven02]

I have created and deployed a new app for DFS Replication called "NAS_DFS" which consists of pulling a csv file from each server
D:\data\splunk\dfs_replication\dfs_replication.csv

This app contains 163 clients in the server class (in the right screenshot) but when searching only 18 hosts are returning (left screenshot).

I'm not sure why only 18 hosts are showing.

inputs.conf

[monitor://D:\data\splunk\dfs_replication\dfs_replication.csv]
index=ad
interval=60
source=otl_dfs
sourcetype=csv
disabled=0
crcSalt=<SOURCE>

app.conf

[install]
state = enabled

[deepashri_123]

Hey@davidcraven02,

You need to check the following points:
1. Was the app being pushed on the hosts from which data is not coming?ie, the app having inputs.conf.
2. Check if any error are coming in index=_internal for that particular host if not sending data.
3. Check if the followtail logs are coming in _internal for those particular host.
4. If all these conditions are satisfied then your problem has to be crc_salt , Removing crc_salt should solve this but might also re-index the data which is already indexed.
5. Also you can check initCrcLength for the issue.

Refer this link:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Howlogfilerotationishandled

Let me know if this helps!!

[damien_chillet]

Hi David,
Is there a timestamp in the CSV fields?
Could you try run the search on all time see if you get different results?