Hi the following were the `splunkd.log` messages in the deployment client. I don't know why it isn't showing any warnings or errors and also it didn't indexing anything. But you can see that it took too long to write the second and third log file. Never experienced this before.
11-06-2015 20:08:12.187 -0500 INFO HttpPubSubConnection - SSL connection with id: connection_10.200.160.21_8089_svcldprdsea01.aeo.ae.com_svcldprdsea01.ae.com_3B3FD84B-BB72-460F-81D9-41DC7F97EA09
11-07-2015 04:26:19.118 -0500 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/splunkforwarder/var/log/splunk/metrics.log'.
11-07-2015 04:26:19.155 -0500 INFO WatchedFile - Will begin reading at offset=24999200 for file='/opt/splunkforwarder/var/log/splunk/metrics.log.1'.file='/opt/splunkforwarder/var/log/splunk/metrics.log.1'.
Following is my `inputs.conf`
[monitor:///opt/endeca/apps/ab/logs/dgraphs/DgraphA1.log]
index=search
crcSalt =
sourcetype=log4j
[monitor:///opt/endeca/apps/ab/logs/dgraphs/DgraphA1.reqlog]
index=search
crcSalt =
sourcetype=log4j
[monitor:///opt/endeca/apps/ab/logs/dgraphs/DgraphA1.start.log]
index=search
crcSalt =
sourcetype=log4j
[monitor:///opt/endeca/apps/ab/logs/dgraphs/DgraphA1.updatelog]
index=search
crcSalt =
sourcetype=log4j
[monitor:///opt/endeca/apps/ab/logs/provisioned_scripts/AEBaselineUpdate.log]
index=search
crcSalt =
sourcetype=log4j
Not sure why I haven't seen any logs flowing into Splunk. Please suggest why it's not happening.