Hi, First of all you should not be modifying the files present in $SPLUNK_HOME/etc/system/default location which is shipped by SPLUNK. If you want to modify them, please create a new .conf file in either $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps//local directory with your setting. Please check splunkd.log and see if you are getting any error there. It appears to me you have modified some settings in web.conf file in $SPLUNK_HOME/etc/system/default which might be causing this issue. ... View more

Check if there is any error message at splunkd.log/web_service.log at $SPLUNK_HOME/var/log/splunk. I had similar issues in the past and I am not able to identify the root cause even doing some troubleshooting on the log files I mentioned. To fix the web server issues in my case, I have to reinstall Splunk using the same version already previously installed and it had worked. Try to revert the previous changes you had deployed to check it can be the root cause. Please run a backup first at the entire /etc folder before you deploy any changes, just to make sure you are able to recover all the configuration and apps. ... View more

Sort of... You would monitor the location the files are produced: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Monitorfilesanddirectorieswithinputs.conf You would create a search looking for new events from the input you just created. Assuming your inputs, timestamps, and timezones are set correctly, any new events would indicate a new file. In which case, you would schedule a search every X minutes, configure the email to generate a single email, and attach the search results. ... View more