I use Splunk to monitor a basic text file on multiple Windows Servers with the following stanza in inputs.conf: [monitor://C:\Windows\System32\logfiles\Ansible.log] disabled = 0 sourcetype = Ansible index = sw interval = 10 This always works at first and I can find all the events inside Splunk. But that Ansible.log file is regularly updated by Powershell or ScheduledTask or something similar and over time several servers will have 0 events for that Ansible.log file. In the file system, the file has been updated recently, but the Splunk Universal Forwarder just doesn't sent the updates but those servers have events from other SourceTypes. Restarting the SplunkForwarder service, the server, upgrading the Splunk Universal Forwarder does not fix the issue. The file is a simple raw text file in (typically UTF8 but I've tried multiple formats). I've make sure permissions are correct and the service which runs the SplunkForwarder has read rights. What else can I do to have the SplunkForwarder send updates to that file? ... View more

Hello Splunk Community, I'm trying to write a query to show me a chart (or table) for all hosts in my index in the last 45 min that haven't written a specific string to a log. The below query shows me that it has happened on a single host, but I want two columns in a table: column 1 showing the host name and column 2 showing how many times that string appeared in that log (including all the hosts with 0 times). Query so far: index="index" source="C:\\Windows\\System32\\LogFiles\\Log.log" "Detection!" earliest=-45m latest=now | stats count by host ... View more