There a way to manually run stream file collector against previously collected files?
As long as that file has not been deleted, or, you enabled the Destructive flag, you can collect the same file multiple times
the collector for file system where it only lets you specifc a directory, will each full manual run gather everything in that directory regardless of having been seen before?
i was getting odd results where i had 2337 event files, some runs would execute and i'd see like 600 events show up in my final destination
Are you using the ' file monitor' source? or 'file system' collector?
as for the 2337 vs 600 events .. will need to do some digging .. it could be some factors like event breakers, pipeline .. etc ..