Hi, lately we've been checking how many files our splunk is indexing, and we noticed that it "skips" some files... We checked by searching:
index=our_index | stats dc(source) index = _internal group = per_so* series=*.ourfile | stats count
And both ways we got the same results, which are not all the files we indexed.
Try running following on your forwarder instance. See if Splunk is monitoring all the files you've configured for monitoring (will prompt for admin credentials for that Splunk instance)
$SPLUNK_HOME/bin/splunk list monitor
well the forwarder doesnt write log when it monitors, only with batch input for some reason. Today we indexed some logs, and we saw one of the files in the forwarders log, but we could not search it...
I wonder if it has something to do with the fact that we added a few indexers recently.
Is there something i should update in the search head when i add indexers?