Splunk Search

How to find the missing source files that are not indexed

Path Finder

Hi team,

I have 10 different hosts that are sending data to the SPLUNK every day
they send some csv files daily C:\SPLUNKCEBU\xxxx.csv, etc

Now i want to find out for a particular day if the data from all the files from all hosts are indexed or not (if not indexed then i can check my host if the files are present are not)


Tags (2)
0 Karma

Ultra Champion

you can most likely use a simple search to validate your inputs with help of the source attribute, e.g.

your_search | timechart span=1d distinct_count(source) values(source)


0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!