@ChloeMica, If you are defining source explicitly in inputs.conf then splunk uses that string to match not the original filename. "Detail: This feature examines the source key; if source is set explicitly in the stanza, that string will be matched, not the original filename." - http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Inputsconf Could that be your case ? ... View more