Splunk Search

Why is splunk not detecting All Files during search?

New Member


Hi, im currently facing problem where splunk can detect all my files in directory but when doing searching, splunk cannot detect all of it? any ideas?




Labels (1)
0 Karma


Hi @aamirulh,

let me understand: do you want to have the list of a files in a folder read by Splunk or a simpli list of them?

In the first case you can list the souces read by Splunk, (if you want the files in "/var/log/" you can run something like this:

your_search source="/var/log/*
| dedup source
| sort source
| table source

 if instead you want to list all files id a folder, you have to create a scripted input that lists the files ("ls -al" in Linux and "dir" in Windows) and then display results.



0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...