I have a client server with a universal forwarder configured to forward data to an index server. On the client server, I have a folder "X" full of CSV files. If I create a remote folder monitor for the client server folder "X" on my deployment server and deploy it to the client server. Will Splunk process the CSV files that are already there. or will Splunk not do anything until the folder contents change? ... View more

I have a 4-server Splunk scenario: index server deployment server search head server deployment client server (w/ a Splunk Universal Forwarder known to be configured correctly and working, i.e., it forwards to the index server ok) On the index server, I placed the following 200-row csv file and successfully ingested it into the index foo_index using oneshot: "DateTime","foo" "10/1/2019 12:03:20 AM","cat" .. 198 more similar rows "10/1/2019 11:55:20 PM","dog" After verifying that the 200 events were ingested, I edited the csv file and added 200 more rows: "DateTime","foo" "10/1/2019 12:03:20 AM","cat" .. 198 more similar rows "10/1/2019 11:55:20 PM","dog" "10/2/2019 12:01:20 AM","mouse" .. 198 more similar rows "10/2/2019 11:59:59 PM","mouse" Then, on the deployment server, I created a remote folder monitor and deployed it to the deployment client server which created \etc\apps\xxx\local\inputs.conf on the deployment client server: [monitor://D:\foo] disabled = false index = foo_index sourcetype = csv crcSALT = <SOURCE> Then, I copied the CSV file to D:\foo on the deployment client server ( D:\foo was empty prior to my dropping the CSV file into it) The new 200 rows were not ingested. Why not? ... View more

This cli search command works from a machine with a universal forwarder: splunk search "index="foo" earliest=-7d | sort -SensorDateTime | stats first(SensorDateTime) by bar" -preview false -uri https://indexer:8089 Output in cmd window: INFO: Your timerange was substituted based on your search string bar first(SensorDateTime) ---------- ------------------------------------ C:\x\A.txt 10/2/2019 9:59:11 PM C:\x\B.txt 10/2/2019 9:59:11 PM C:\x\C.txt 10/2/2019 9:59:11 PM C:\x\D.txt 10/2/2019 9:59:11 PM C:\x\E.txt 10/2/2019 9:59:11 PM C:\x\F.txt 10/2/2019 9:59:11 PM C:\x\G.txt 10/2/2019 9:59:11 PM C:\x\H.txt 10/2/2019 9:59:11 PM C:\x\I.txt 10/2/2019 9:59:11 PM C:\x\J.txt 10/2/2019 9:59:11 PM C:\y\A.txt 9/30/2019 9:53:20 PM C:\y\B.txt 9/30/2019 9:53:20 PM C:\y\C.txt 9/30/2019 9:53:20 PM C:\y\D.txt 9/30/2019 9:53:20 PM C:\y\E.txt 9/30/2019 9:53:20 PM C:\y\F.txt 9/30/2019 9:53:20 PM C:\y\G.txt 9/30/2019 9:53:20 PM C:\y\H.txt 9/30/2019 9:53:20 PM C:\y\I.txt 9/30/2019 9:53:20 PM C:\y\J.txt 9/30/2019 9:53:20 PM But, when I do this: splunk search "index="foo" bar="C:\x\A.txt" earliest=-7d | sort -SensorDateTime | stats first(SensorDateTime) by bar" -preview false -uri https://indexer:8089 or splunk search "index="foo" bar="C:\\x\\A.txt" earliest=-7d | sort -SensorDateTime | stats first(SensorDateTime) by bar" -preview false -uri https://indexer:8089 I get nothing back. I expect to get back one event: bar first(SensorDateTime) ---------- ------------------------------------- C:\x\A.txt 10/2/2019 9:59:11 PM Why can't I include bar="C:\x\A.txt" in my search and get results? p.s. This search works fine when I execute it from the indexer or search head web page: ... View more

I'm trying to learn how Splunk works by presenting it small sets of data and observing the results. The results of my most recent test really surprise me. I'm no sure what to make of it I have a 4-server Splunk scenario: deployment server index server search head server A deployment client server (w/ a Splunk Universal Forwarder) I used the deployment server web interface to create a *.csv files monitor on the deployment client server. Using csv sourcetype. The data is ingested into a single index. I created 3 CSV files: testdata01.csv, testdata02.csv, and testdata03.csv. Each csv file has a heading row and 30 "event" rows, like this: "Date","Field1","Field2","Field3","Field4","Field5" "2019-01-01 00:00:29 ","testData1-86400","testData2-86400","testData3-86400","testData4-86400","testData5-86400" . . . "2019-01-01 00:00:00 ","testData1-86371","testData2-86371","testData3-86371","testData4-86371","testData5-86371" For each data row, the Date decrements by one second (:29 down to :00). Likewise, the numeric value that appears in a row's 5 fields decrements by 1 (86400 down to 86371). The three CSV files each have the exact same set of 30 events. I dropped the three files into the monitored folder and then performed a search from the search head. To my surprise, I see only 30 events from testdata01.csv. It appears that Splunk ignored the 30 events from testdata02.csv and the 30 events from testdata03.csv I expected all 90 events to be ingested because each set of 30 has a unique source. Why does Splunk selectively ignore events (not ingest events) from multiple CSV files? ... View more