Deployment Architecture

IIS log exceeded index amount

cschafer1
New Member

Hello,

We installed the splunk forwarder on a server doing about 134 meg log per day. Today it has done about 734 meg in the last 24hours...Log file as it sits is only about 140 meg

I am stumped we have forwarders working as designed.. We have standard conf files that we use..

If anyone has any suggestions on why the indexer amount ballooned to that amount? I can post conf files if any one as a feeling.

Thank you in advance.

Cory

Tags (1)
0 Karma

lukejadamec
Super Champion

Can you post the inputs.conf for that monitor? How long has this been running? You said new, is it new new, or was new?

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Run the following search to see what spiked (use a graphical chart to visualize it fast) and replace YOURHOSTNAME with the host in question:

index=_internal source=*license_usage.log type=Usage h=YOURHOSTNAME | eval MB=b/1024/1024 | timechart span=1d sum(MB) by s useother=false usenull=false

Do this across the last few days or week to get a good trend line on that host. This should point out exactly where to focus efforts because you'll know what source suddenly had more messages. Then you can look at that source to see what you might have that could cause such a spike. Usually it means that something broke (an app or hardware) that spewed tons of messages for a few hours.

--
Jesse Trucks
Minister of Magic
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...