I have created and deployed a new app for DFS Replication called "NASDFS" which consists of pulling a csv file from each server
This app contains 163 clients in the server class (in the right screenshot) but when searching only 18 hosts are returning (left screenshot).
I'm not sure why only 18 hosts are showing.
[monitor://D:\data\splunk\dfs_replication\dfs_replication.csv] index=ad interval=60 source=otl_dfs sourcetype=csv disabled=0 crcSalt=<SOURCE>
[install] state = enabled
Is there a timestamp in the CSV fields?
Could you try run the search on all time see if you get different results?
You need to check the following points:
1. Was the app being pushed on the hosts from which data is not coming?ie, the app having inputs.conf.
2. Check if any error are coming in index=internal for that particular host if not sending data.
3. Check if the followtail logs are coming in _internal for those particular host.
4. If all these conditions are satisfied then your problem has to be crcsalt , Removing crc_salt should solve this but might also re-index the data which is already indexed.
5. Also you can check initCrcLength for the issue.
Let me know if this helps!!