I think I might have found the issue.
I reviewed the logs on one of the servers that I deployed this app to, but I didn't see any issues. I did see in the logs that the app deployed successfully. Then as part of my troubleshooting I restarted the SplunkFowarder service on one of the windows servers so I could get some clean log files. As soon as I restarted the service, I started getting the data into the indexers.
I never had to manually restart the service before after deploying new apps. Is there something I need to do differently when deploying file monitoring apps? For example, it there a setting I need to put into the deployment app so it automatically restarts the service when the app gets deployed? Once i'm done testing, I am planning to deploy this app to around 200 servers, and I would hate to have to manually restart the SplunkForwared service on all these servers.
Thanks,
... View more