Hi do you have IPs open on AWS Security group of splunk cloud for all your UFs. That could be one of the reason. Try doing telnet from your machines to Cloud indexer on indexing port. ... View more

Well in that case try /opt/splunkforwarder/bin/splunk list inputstatus and check if the file you are trying to monitor is being read by splunk. if yes then your file is monitored and issue is with forwarding for which you need to check splunkd.logs and look for data forwarding or parsing errors. If not then check if path in your monitor stanza is correct and also if splunk has proper rights to read the file. Also are you using any HF in between or sending data directly to Splunk Cloud? You might need to get the IPs opened between your servers and Splunk Cloud env. ... View more

Do btool on your forwarder for inputs.conf and see if "ignoreOlderThan" is set by default. This might be the reason that older files are ignored. ... View more