Hi,
your input and search looking correct. Steps from here ...
1) is your file path correct?
2) are there any problems splunk reports. look at index=_internal sourcetype=splunkd "tslog.txt" and check for any erros.
F.e. the following example shows from the bottom to the top, that the tailingprocessor following the file and licenseusage reports that data are getting indexed.
02-10-2017 11:13:58.549 +0100 INFO LicenseUsage - type=Usage s="C:\\windows_log_test\\folder(123)\\test.log" st=tmp h="asdf" o="" idx="tmp" i="0E508918-B08F-4E61-97AD-BC9C4B6D706D" pool="auto_generated_pool_enterprise" b=9 poolsz=53687091200
02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Adding watch on path: C:\windows_log_test\folder(123)\test.log.
02-10-2017 11:12:26.733 +0100 INFO TailingProcessor - Parsing configuration stanza: monitor://C:\windows_log_test\folder(123)\test.log.
Anything else would be noticable.
3) You can check if there is data in your index at all (if no other data is expected in the index): Settings -> indexes -> current size/event count
Edit: some additional things you can try
4) alter your splunk spl, f.e. only search for index=ts OR index=* sourcetype="ts"
5) check the state of your input: | rest splunk_server=local /services/admin/inputstatus/TailingProcessor:FileStatus | transpose | search column=*tslog*
Reference for 5) http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/
6) While adding the log with the wizard at some point you got a preview of your data, correct? If so are the timestamp correct? if - for some reason - the events get indexed in splunk with a timestamp in the future your search wont find these logs or they wont get indexed at all.
Maybe something will show us, whats going on.
... View more