If I use the Main index and using a Universal Forwarder I successfully index all event data in the Application, System and Security logs from a windows server.
However if I create with a new install of splunk custom indexes for each log type above the only events I seem to get in the logs are from the date that the custom indexes are created and not back to the first log entry on the server.
Can someone tell me if I need to instruct splunk to index all data or should it automatically pull all the events from the logs right back to the first one created?
Also using custom indexes, how do you add the Host and source types so they show on the Search Summary screen?
The only way I seem to be able to view them is by typing "index=log name" in the search box?
Thanks
... View more