How to find the missing source files that are not indexed

[deepthi5]

Hi team,

I have 10 different hosts that are sending data to the SPLUNK every day
they send some csv files daily C:\SPLUNKCEBU\xxxx.csv, etc

Now i want to find out for a particular day if the data from all the files from all hosts are indexed or not (if not indexed then i can check my host if the files are present are not)

Thanks
deepthi

[kristian_kolb]

you can most likely use a simple search to validate your inputs with help of the source attribute, e.g.

your_search | timechart span=1d distinct_count(source) values(source)

/k