Monitoring Splunk

Why were the logs from existing files not displayed before adding new files to the directory?


Hello splunk community!

For some context, I started by adding some files into a directory first, then i configured the monitor processor of the splunk universal forwarder in inputs.conf  to monitor the directory. However, (after restarting splunk universal forwarder) when i searched for the index in splunk enterprise, there were no search results. Afterwards, i added some new files to the directory and suddenly the logs appeared on the search and what confuses me is that it does contain logs from the existing files in the directory.

is anyone able to explain why the logs of existing files didnt appear in the first place? and only appeared after i added new files to the directory?

Thank you in advance!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>