unable to index files after deleting events and creating new sourcetype

[Cuyose]

I know splunk has always been a pain when trying to "fix" indexed data. I have deleted events from monitored paths in inputs because they were not indexed correctly via the sourcetype I created in props.conf. So after deleting the bad data, I fixed the props and inputs in the deployment App, pushed and verified the new files got to the servers.

Now even new files in the monitored directory are not being indexed. Ive event restarted the cluster master rolling restart of indexers, set new crcSalt values, etc. Nothing.

[Cuyose · Accepted solution]

I had an extra : in my input stanza. For anyone also looking for troubleshooting and that comes across this. The easy way, and what I should have done first is check the _internal index for the file path I was thinking I was monitoring.