Getting Data In

clearing buffered events

mcbradford
Contributor

We have a system where the log rotation confuses splunk and splunk starts attempting to reindex the log. This happened 3 days ago and we Splunk is still trying to catch up. How can I clear the "buffer" and just tell splunk to start from this point forward? I think the throughput is saturated and it is sending as many events it can. When the problem started, we were getting about 9400 duplicate events per 1 event. We are now at about 50 to 1. Any ideas on how to make this stop?

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

There are probably several possible reasons for why this is happening, but it's hard to tell from the limited information.

Have you tried playing with the ignoreOlderThan and followTail parameters for inputs.conf?

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

/Kristian

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...