are you file monitoring? If you are, the issue has to do with the following: When using File monitoring input or folder monitoring input do not use recursive search or three dot notations (...) instead prefer to use non-recursive search or asterisk notation (*). Example: [monitor:///home/*/.bash_history] is much better programmatically then [monitor:///home/.../.bash_history] When you must compulsorily use recursive search, then: Make sure no. of total files under the main root directory you are searching is not huge. Make sure there are no cyclic links that could cause Splunk to go into an infinite loop.
... View more