Greetings, I have a problem with my Splunk index. My Splunk indexed data from a file log in FTP Server using FTP Pull Add-On. But the problem is, there is missing file content that my Splunk index ...
See more...
Greetings, I have a problem with my Splunk index. My Splunk indexed data from a file log in FTP Server using FTP Pull Add-On. But the problem is, there is missing file content that my Splunk index did not index. For example: file_name.log has some 6 content (6 rows data) But my Splunk did not index all of 6 content on that file, resulting only 5 content (5 rows data) indexed. So, in my Splunk, there are 5 events produced. My question is: 1. How to track my Splunk index, when indexing the data with all details, like the file content, the time-indexed, and etc? 2. How to fix my Splunk index miss some of the file content when the index happens? Thanks in advanced