I set up our print server to send print job info to Splunk recently and it worked for awhile.
For some reason, it has stopped working and I have no idea why.
Within Windows Infrastructure, I can see print job information within the Print Job Viewer on Monday but nothing since.
I searched the info directly (Search->chose the print server as the source) and all of the recent print job information is there.
What could cause it to stop showing in the Print Job Viewer?
my original inputs.conf file got overwritten within the Windows Infrastructure folder in the forwarder
View solution in original post