Hi Everyone,
Need help regarding event breaking, below is my current scenario:
One my log file in the indexer is updating not updating the log in frequent intervals, for example:
Event starts with date in format "2015-10-01 07:31:09.733+0000" and this event will end writing data after 5min with 'n' number of lines, and next event will start with the same date format. The problem is as the log is taking 5min time to finish writing the event, splunk splitting one event into three or four different events.
Kindly help me out with this problem, let me know if more information is required.
Thanks in Advance
You can try using the time_before_close
parameter inside inputs.conf
and setting it to something like 300
but be sure to test it on one server/file first and if you decide to keep it, be sure it is only on these kinds of inputs because this will cause a 5-minute delay in getting events into Splunk.
You can try using the time_before_close
parameter inside inputs.conf
and setting it to something like 300
but be sure to test it on one server/file first and if you decide to keep it, be sure it is only on these kinds of inputs because this will cause a 5-minute delay in getting events into Splunk.
Thanks Woodcock, for your inputs!
The usage of this parameter is working fine for me..Thanks!