I answer your question inline as bellow. 1)after changing the port in Splunk indexer, will I be able to search all the past data which was indexed using port 9997? Yes. The past data is already stored in index server, you can search them without problem. 2)Will I get latest data using new port without any issues? Yes, you can get data with new port. But you need to change configuration of all forwarders. If you use deployment server, you can deploy new configuration to all forwarder easily. If not, you need to change them manually. 3)Are there any special modifications we need to do for this to work properly? Please let me know how I can change the port without causing any issues in existing data. It does not affect existing data. Most problem I think is to change configuration of all forwarders. ... View more

What _d_ mentioned looks good and I would say that you might want to double check the path and permissions for the files to be monitored as well as the access rights for the Splunk user when running your search, including making sure that the Splunk user has access to the index you are sending these events to. So using: [monitor:///usr/sap/IXD/SYS/profile] disabled = false index = erp crcSalt = <SOURCE> Followed by making sure that when you search that you specify search index="erp" * Should be fine as long as all the requirements are met for monitoring all the files. One last thing to consider. Is there any sort of file lock that might be on those files that would prevent Splunk from opening them to index? ... View more

Thanks for your help 🙂 ... View more