Why is Splunk OneShot not working?

[sini]

Hi all,

Having a strange issue. splunk add oneshot suddenly stops working.

I have tried to re-read a file using 

splunk add oneshot -source filename.csv -index test -sourcetype mysourcetype

-> Oneshot 'filename.csv' added

After I deleted the events from index "test". However suddenly events do not appear anymore. Search for with "All Time" scope always returns 0 results. I cannot find any problems in the _internal log for the forwarder.

Regards

[sini]

If I copy the file to another directory it starts working again, I can oneshot again and again and the results are there and duplicating with each oneshot in the test index. I guess it's one of the many, many bugs. According to btprobe the file hash is also not found in the fishbucket. spunkd is running as root so it cannot be a permission issue either and oneshot was also carried out with root permissions.