log injection configuration

[raghunandan1]

Recently configured a new input that has successfully ingesting logs but appears to be working intermittently. There is large gaps in logs that we have confirmed are present and being created regularly from the source server.

Example : Logs are captured 8th December and 16 December only. So, here 9th December to 15nth December logs are not captured

We have created custom app on our deployment server and push that app across all the deployment slaves.

The data flow is coming from source-->Universal forwarder-->Heavy forwarder--> Splunk cloud

we have created Inputs.conf 

[monitor://F:\Polarion\data\logs\main\*.log.*]
sourcetype = catalina
index = ito_app
disabled = false
ignoreOlderThan = 7d
initCrcLength = 10000

Please help on the issue

Thank you

[VatsalJagani]

@raghunandan1 - Please search in the index=_internal to see if you have errors related to file monitoring from those hosts.

I hope this helps!!!

[isoutamo]

Hi

this https://community.splunk.com/t5/Getting-Data-In/Only-first-line-from-logfile-is-logged/m-p/672184#M1... is probably quite similar case?

r. Ismo