Getting Data In

clearing buffered events

mcbradford
Contributor

We have a system where the log rotation confuses splunk and splunk starts attempting to reindex the log. This happened 3 days ago and we Splunk is still trying to catch up. How can I clear the "buffer" and just tell splunk to start from this point forward? I think the throughput is saturated and it is sending as many events it can. When the problem started, we were getting about 9400 duplicate events per 1 event. We are now at about 50 to 1. Any ideas on how to make this stop?

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

There are probably several possible reasons for why this is happening, but it's hard to tell from the limited information.

Have you tried playing with the ignoreOlderThan and followTail parameters for inputs.conf?

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

/Kristian

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...