Hi, Thank you very much for your helpful suggestion! We cracked the issue by doing as below. 1) Removed all the forwarded inputs that referenced network shares and just used local directories. Only 3 are present now (one of which must be working): 2) Renamed one of the log files to have the extension .log 3) Adding a new line, the text has appeared in Splunk We think its the third one we tried that's based on the regular expression that you suggested. Thank you very much for pointing us the right direction!       ... View more

Hi, None of them is working, but according to TailingProcessor:FileStatus, it looks that the forwarder is successfully reading all files. "Local System account" is selected on the tab "Log On" in the property of "SplunkForwarder Service" running on the source server. We are using Splunk Enterprise 6.6.6. Thank you. ... View more

HI, Thank you for your quick reply. I'm attaching the conf. --- inputs.conf --- [monitor://\\vmappt123\CREMS-PLUS-IF\LOG\] disabled = false index = main sourcetype = whitelist = *.* [monitor://\\vmappt123\CREMS-PLUS-IF\LOG] disabled = false index = main [monitor://\\vmappt123\CREMS-PLUS-IF\LOG\*.log*] disabled = false index = main [monitor://D:\App\IVIF0001DJ\LOG] disabled = false index = main [monitor://D:\App\IVIF0001DJ\LOG\*] disabled = false index = default sourcetype = MXG-CREMS Plus - Realtime [monitor://\\vmappp123\CREMS-PLUS-IF\LOG\*] disabled = false index = main sourcetype = MXG-CREMS Plus - Realtime [monitor://\\vmappt123\CREMS-PLUS-IF\LOG\*] disabled = false index = main [monitor://\\vmappp123\CREMS-PLUS-IF\LOG] disabled = false index = main [monitor://D:\App\IVIF0001DJ\LOG\*.log*] disabled = false index = main sourcetype = MXG-CREMS Plus - Realtime [monitor://\\vmappp123\CREMS-PLUS-IF\LOG\*.log*] disabled = false index = main --- End of inputs.conf --- --- outputs.conf --- [tcpout] defaultGroup = my_search_peers [tcpout:my_search_peers] server = v-spk01p:9997, v-spk01c:9997 autoLB = true --- End of outputs.conf ---   ... View more