Why can't I see the group tcpin_connections?

[albinortiz]

I am trying to leverage the information on the metrics.log file.
I am using this: index=_internal source=metrics.log group=tcpin_connections
This was working before and for some reason unknown it is not any more (nobody knows what happened).
I created a | table groups so I could see all the groups in the file and I could not see tcpin*.
I go to the log file and I actually see tcpin*
Any ideas on what's going on?

[nikhilteja]

index=_internal source=metrics.log* group=tcpin_connections hostname=<the UF or the server you're checking> should work