Why is Splunk not reading existing files from same server?

[ram254481493]

Hi

Currently, I have setup inputs.conf, Splunk is reading all the directories in the inputs file- but not reading one file.
I tried using crcSalt but nothing works.
It's reading first 3 monitor paths but not reading the last one.
All three are from the same server and the log exists.

[monitor://D:\Talx.xxx\EDRService.xxxx\AppLogs*]
disabled = false
recursive = false
index = xxxxxx
sourcetype = xxxxxx

[monitor://D:\AuditAndxxxxxx\TWNEmployerServiceP0xxxxxx.trace.*]
disabled = false
recursive = false
index = xxxxx
sourcetype = xxxxxx

[monitor://D:\AuditAndxxxxx\TWNEmployerxxxxx.*]
disabled = false
recursive = false
index = xxxxx
sourcetype = xxxxxx

[monitor://D:\Talx.xxxxxxx\TWNEmployer.xxxxxx_Logs\AppLogs.*]
disabled = false
recursive = false
index = pxxxxxx
crcSalt = 
sourcetype = xxxxxxxxxxx

[richgalloway · Accepted solution]

Verify Splunk has read access to the directories and files it is to monitor.
Check splunkd.log for related error messages.
Run splunk btool --debug inputs list to verify the configuration.
Run splunk list monitor to verify what Splunk is monitoring.

[ram254481493]

sure thanks for your help it was a issue with my monitoring stanza. And its resolved.

[richgalloway]

To help future readers, please add and accept an answer explaining how you resolved the problem.

[ram254481493]

hi i am not able to accept the answer , i cannot see the accept answer button. In my monitoring path i had an extra space so its not reading the logs , i removed the extra space and i restart the forwarder , it starts flowing the logs.

[ram254481493]

Thanks now i am able to do it