Getting Data In

After removing a monitor on one log file from all my Splunk forwarders, why do I still see search results for that log file?

smanda
New Member

I removed a monitor on one log file from all the Splunk forwarders in the inputs.conf file and restarted Splunk forwarder and Splunk indexers. However, we still see the new logs been indexed and search results returned.

0 Karma

ddrillic
Ultra Champion

What is the btool telling on the forwarders?

 ./splunk cmd btool inputs list monitor

Is it listing the removed files?

0 Karma

smanda
New Member

Output of the command is not listing the removed files.

0 Karma

ddrillic
Ultra Champion

And you see fresh data from this particular host on which you ran the btool command, right? Doesn't make any sense.

Anybody has any idea?

0 Karma

smanda
New Member

Yes. Its showing the monitors which we configured in inputs.conf right now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...