|
I'm using Splunk 4.2.1 Enterprise Trial I have a directory C:\TestLogs\ set up to be the root dir of log files to consume for indexing. Yesterday, I dropped 4 directories of 3 files each in there. Only 6 files showed up in the Splunk Search Summary page. (I see those files listed in C:\Program Files\Splunk\var\log\splunk\license_usage.log) How do I get Splunk to index the other 6 files? Today, in C:\Program Files\Splunk\var\log\splunk\license_audit.log, I see:
Did I exceed my quota for the trial? |
|
Yes, user has access to the log files. They are not binary files, and they are not duplicate copies. I rebooted the PC, and it appears to have resumed indexing the remaining log files. In C:\Program Files\Splunk\var\log\splunk\license_audit.log, I see: 07-13-2011 00:00:00.568 INFO LicenseManager-Audit - Audit:[quotaExceededCount=0, lastExceedDate=0, peak=37783088, rolloverCount=2, totalCumulativeBytesAtRollover=37783088, todaysBytesIndexed=37783088, licenseSize=524288000] |
|
Hi NK did you search for your logfiles in splunk, like source=YourLogFiles - are they really not there? there could be many reasons for that:
I don't think you ran into a quota problem, because the log states
which means you had no quote exceeded. regards |
