I am trying to index 555 JSON files accumulating to 293MB.
My inputs.conf is directed at the directory, assigned to the correct index established in indexes.conf, and sourcetype established in props.conf. Props.conf additionally contains KV_MODE = json and TRUNCATE=0. All these configurations have worked on a previous implementation of this setup on a different system.
Ultimately the files are recognised under the data inputs view in Splunk, however the index registers 0 events.
As mentioned, these settings worked in a previous implementation on a different system.
Wondering if anyone has come across similar issues, whether it is with file sizes or JSON implementation itself.
... View more