Hello splunk community!
For some context, I started by adding some files into a directory first, then i configured the monitor processor of the splunk universal forwarder in inputs.conf to monitor the directory. However, (after restarting splunk universal forwarder) when i searched for the index in splunk enterprise, there were no search results. Afterwards, i added some new files to the directory and suddenly the logs appeared on the search and what confuses me is that it does contain logs from the existing files in the directory.
is anyone able to explain why the logs of existing files didnt appear in the first place? and only appeared after i added new files to the directory?
Thank you in advance!
