Splunk Search

Rails long requests get split in to 2 events

aviramradai
Explorer

Hi,

I have rails requests which take more then 15 sec. Rails write to the production.log in 2 steps.
It seem that splunk create 2 events from each part on the prints to the log.

It there a way to tell splunk to wait till the end of the log message print for XX seconds?

Thanks,
Aviram

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Is your application using a write buffer, or a slow process and writing slowly the events in chunk (cutting events in the middle of the line ? )
you can use the setting time_before_close in inputs.conf on the forwarders for this monitor, to force Splunk to wait longer before detecting the EOF.

see http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Inputsconf
time_before_close =
* Modtime delta required before Splunk can close a file on EOF.
* Tells the system not to close files that have been updated in past seconds.
* Defaults to 3.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...