So I am monitoring a folder for all of the files in the folder on a splunk universal forwarder. In the SplunkUniversalforwarder/etc/system/local the config is:
[monitor://\*.csv]
disabled = 0
index = abc
sourcetype = abc_sourcetype
ignoreOlderThan = 14d
So far I am only getting one file from the folder, when there are about 20. What do I need to do to fix this?
↧