I managed to find a solution to this problem, the configuration is correct only the problem was that the user running the splunkd service on the windows machine was a local user and not a domain user. Switching to domain user solved the problem. However, I'm now faced with another problem - what to do when the files are collected from a different network domain which splunk does not have access to? ... View more

No you can't. Splunk never reads a file backwards. If it starts at the end, it simply skips the beginning and reads forward. If you're trying to do this, I would suggest you simply create a new batch/sinkhole input in inputs.conf, pointing at a different location, or use the the oneshot command to simply index each file on demand. Note also that you can't add arbitrary index-time fields to your data using the ***SPLUNK*** method anyway (only specific Splunk keys like host , source , sourcetype , index ), and would need to use additional TRANSFORMS to make it work. You might have similar problems using any other method, however. ... View more

Can you send to me too please ... View more