This question is unsolvable. To be solvable, the minimum information set would be: The input stanza configuration A description of the paths on disk Other things that are likely needed A review of any messages related to the files in splunkd.log A search over all time to see whether any of the data is collected ... View more

this format gets me close, but i dont understand how to adapt all this to my input data. I dont understand alot of what you put in here or mean for me to replace, some is obvious, other parts are not. I'm using a Windows SPLUNK instance, and so do I need to escape all these caharacters? some stuff in here isnot anything i have ever seen. {chhose log/debug index}, etc... can you explain it more? perhaps use a sample of my data from above for your example? ... View more