I'm having an issue where a specific log file is not forwarding, but others in the same directory and Splunk app are forwarding.
The files in question are:
server.log
server.log.0
The .0 is just where the server.log rolls over to so I don't care about forwarding that as it is just stale and duplicate data. I have created an inputs.conf file for this directory and simplified it just monitor "server*".
My issue is that server.log.0 is showing up in Splunk whereas server.log is NOT. If I change the inputs .conf to specifically look for server.log then nothing shows up in Splunk.
Both files have the same owner and read/write permissions. What could be causing this? It seems like all variables are equal but I'm getting different results.
Here is the inputs.conf file in question:
[monitor:///api/logs/server.log]
sourcetype=serverapi_logs
index=api
[monitor:///api/logs/error.log]
sourcetype=errorrapi_logs
index=api
And an ls on the directory:
error.log error.log.0 README.md server.log server.log.0
Try restarting your splunk forwarder to see if it picks up server.log. If that doesn't help, grep for server.log in $SPUNK_HOME/var/log/splunk/splunkd.log and see if there are any errors.
Could you post your inputs.conf please?
Added more info above
were you Specify the new source type in forwarder inputs
the problem is not the permission