Splunk Universal Forwarder not ingesting some of the monitored directory / files

Applicability

Splunk Enterprise

Description

Following file are config to ingest data to splunk.

etc/system/local/inputs.conf
[monitor://D:\AS400\MIM_*]
disabled = false
index = as400
sourcetype = as400
host = MIM

File already exist as follows:

D:\AS400\MIM_230615_000000.txt
D:\AS400\MIM_230615_001500.txt
D:\AS400\MIM_230615_003000.txt
D:\AS400\MIM_230615_004500.txt

However, Splunk didn't ingest the data at all even there are files in D:\AS400 directory.
 

Investigation

In order to check the monitoring status, need to run below 2 command from Splunk universal forwarder.

cd $SPLUNK_HOME/bin
./splunk list inputstatus
./splunk list monitor

From below output, it seems that Splunk mis-interpret the directory as file.

Monitored Directories:
$SPLUNK_HOME\var\log\splunk\splunkd.log
$SPLUNK_HOME\var\log\watchdog\watchdog.log*
$SPLUNK_HOME\var\run\splunk\search_telemetry\*search_telemetry.json
$SPLUNK_HOME\var\spool\splunk\tracker.log*Monitored Files:
$SPLUNK_HOME\etc\splunk.version
D:\AS400\MIM_*

 

Resolution

Update the Splunk monitoring stanza by changing as follows:
 

etc/system/local/inputs.conf
[monitor://D:\AS400\MIM*.txt]
disabled = false
index = as400
sourcetype = as400
host = MIM

 

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release