Why is "Number of files" 1 ?

[Bero]

I have installed latest Splunk and have monitoring on a number of shared log-directories on remote servers.

If I go to Manager/Data inputs/Files & directories I see this:

Full path to your data                  Number of files
\\atappserv\Attracs\Server\Live\Log     213
\\xenapp1\Data (O)\Client\Live\Log      292
\\xenapp1\Data (O)\Client\Live\OldLogs  1   
\\xenapp2\Data (O)\Client\Live\Log      1
\\xenapp2\Data (O)\Client\Live\OldLogs  1

I'm confused about the column Number of files.
\xenapp1\Data (O)\Client\Live\Log contain over thousands of files but it says 292.
The only column that is true is \atappserv\Attracs\Server\Live\Log.
All directories is enabled.

I use a Splunk Enterprise Sales Trial License with 5 GB daily indexing.
Currently it index only 5 MB of 5120 MB at Volume used today.
What could I do to investigate this ?

Regards Roland Bengtsson
Attracs team

[sideview]

One thing I would do, is go to this URL on the splunkd management port (you will have to accept some security warnings as your browser will not like splunkd's self-signed cert)

https://servername:8089/services/admin/inputstatus/

But once you get there you can get live information about all of the data inputs including not just the files that are being indexed, but files in those paths that are being blacklisted or otherwise ignored. I suspect that you'll get some clues why out of thousands of files it's only indexing 292, or why in general the numbers are much lower.

[sideview]

Note that the management port has SSL turned on by default so an https:// URL. Maybe you're typing http://

[Bero]

Is port 8089 opened as standard ? I just got server not found. I use port 8000 but if I but that number in the url above I got

404 Not Found
The path '/en-US/services/admin/inputstatus' was not found.