Hi.
I created a new index with along with a fresh install on a Win7 system a few days ago. It should be pointing to some log files that are continuously being updated. When I first created it, everything looked fine. However, when I run a search today, I'm still being told by Splunk that the latest event is from the time when I initially set up the index. I thought the index was supposed to refresh automatically, so I am puzzled as to why it's not being updated. Does anybody have any pointers where to look to find out why this is happening?
Thanks
↧