I'm using Splunk 4.2.1 Enterprise Trial
I have a directory C:\TestLogs\ set up to be the root dir of log files to consume for indexing. Yesterday, I dropped 4 directories of 3 files each in there. Only 6 files showed up in the Splunk Search Summary page. (I see those files listed in C:\Program Files\Splunk\var\log\splunk\license_usage.log)
How do I get Splunk to index the other 6 files?
Today, in C:\Program Files\Splunk\var\log\splunk\license_audit.log, I see:
Did I exceed my quota for the trial?
Yes, user has access to the log files. They are not binary files, and they are not duplicate copies.
I rebooted the PC, and it appears to have resumed indexing the remaining log files.
In C:\Program Files\Splunk\var\log\splunk\license_audit.log, I see:
07-13-2011 00:00:00.568 INFO LicenseManager-Audit - Audit:[quotaExceededCount=0, lastExceedDate=0, peak=37783088, rolloverCount=2, totalCumulativeBytesAtRollover=37783088, todaysBytesIndexed=37783088, licenseSize=524288000]
did you search for your logfiles in splunk, like source=YourLogFiles - are they really not there? there could be many reasons for that:
I don't think you ran into a quota problem, because the log states
which means you had no quote exceeded.
answered 13 Jul '11, 02:06