For our "ATA42_NETWORK" application we have indexed *.NCD files These files are located in an “input directory” monitored by Splunk for automatic indexing /mnt/slv01/import/ATA42_NETWORK/NCD When we perform a search request on our search head, we did not find all events for all *.NCD files For instance on the indexer server in “input directory” /mnt/slv01/import/ATA42_NETWORK/NCD we have NCD file for A350_MSN_0005 flight 55 and 56 [to102071@de0-lxsolp03 NCD]$ pwd /mnt/slv01/import/ATA42_NETWORK/NCD [to102071@de0-lxsolp03 NCD]$ ls -al A350_0005_F005* ... -r-xr-Sr-x 1 splunk splunk 138235 Apr 5 2016 A350_0005_F0055_2014_09_24_101025.ncd.gz -r-xr-Sr-x 1 splunk splunk 138235 Apr 5 2016 A350_0005_F0056_2014_09_25_105415.ncd.gz ... When we perform the following search on the search head, we found the events for flight 55 but there is no events for flight 56 index=aib_ata42_ncd source=/mnt/slv01/import/ATA42_NETWORK/NCD/A350_0005_F0055* index=aib_ata42_ncd source=/mnt/slv01/import/ATA42_NETWORK/NCD/A350_0005_F0056* Both NCD files have been indexed the same day (Apr 5 2016) and have the same unix rights in the “input directory” : (-r-xr-Sr-x) I have retrieved the two NCD files on my labtop, I have unzipped them and both NCD are strictly identical !!! (same md5sum) ➤ md5sum A350_0005_F0055_2014_09_24_101025.ncd 8edfdbfd2f2294512a84aed17f58c299 A350_0005_F0055_2014_09_24_101025.ncd ➤ md5sum A350_0005_F0056_2014_09_25_105415.ncd 8edfdbfd2f2294512a84aed17f58c299 A350_0005_F0056_2014_09_25_105415.ncd My question: It seems that we have an indexing issue. Do you have an idea of the possible root cause of the problem? ... View more