For my input
[monitor::///home/mataharry/invasionplans/]
index=statesecret
whitelist=*.secret
recurse=true
In the manager > data inputs > files & directories
I can see my input but the column "number of files" is 235
way larger than my actual files
find /home/mataharry/invasionplans/ | grep ".secret" | wc -l
returns only 10
Does it means that the columns if the total number of files in the location, not the number of files indexed
Yes , you are right, the "number of files" is the total number of files detected in the path, not the number of indexed files.
FYI Splunk has to list all the files in the path before applying the whitelists/blacklists/wildcards
Yes , you are right, the "number of files" is the total number of files detected in the path, not the number of indexed files.
FYI Splunk has to list all the files in the path before applying the whitelists/blacklists/wildcards