I have deleted historical events from a source using the command | delete. Before doing this, I had added the stanza disabled=true from the deployment server on the target source input file, pushed the configuration to the forwarder server, and issued the | delete command to delete all the data from the targeted source input file. Finally, from the DS, I reconfigured the targeted forwarder input, by replacing disabled=true to disabled=false, and pushed the changes through Deployment Server, but I do not see anything coming from the forwarder's inputs file. There is no error on the splunk forwarder instance and the indexer instance on splunkd.log that would suggest any issues with the source input.
What am I doing wrong here? Is there a way to enable indexing on that inputs file . I created a separate monitoring stanza for that source input, before I was monitoring the folder where that file was situated. Now I am defining the exact file location, but to no avail.
