I was indexing a years worth of logs (200+GB) from one source path. Data was indexed, but I am trying to understand why I have missing data in a source that was indexed over a 5 days ago. We have a path that contains one event log for each day of the year (366 logs) that needed to be indexed into Splunk. To do this action, I ran a basic inputs.conf stanza of: [monitor://D:\LOGS\IIS\abc\W3SVC105105105\2016\u_ex*.log] disabled = false followTail = 0 index = abc_applogs sourcetype = abc_iis_applogs The data was indexed into Splunk; however, I have been validating the data and I noticed that only 204 out of the 366 log files were actually indexed. The interesting part about that, is the missing data is random. Couple days out of each month and the entire month of December did not get indexed. The files are all independent log file names and match the u_ex*.log path I indicated in the monitor. Is there any know reason as to why Splunk didn't index all the data? There is not indication as to why logs were skipped. ... View more

We are using Splunk 6.4.2 and I have alerting setup on a specific search as follows: index = wineventlogs sourcetype = wineventlog_sec host=SERVER12VWIN OR host=SERVER82VWIN OR host=SERVER13VWIN OR host=SERVER81VWIN OR host=SERVER180VWN OR host=SERVER14VWIN OR host=SERVER15VWIN OR host=SERVER83VWIN OR host=SERVER001VWIN OR host=SERVER049VWIN We would like to be alerted for each event that comes up on the individual host; however, when the alerting happens, it creates multiple events under one alert. Unfortunately, due to the request of only wanting to alert on the specific 10 hosts out of 25 hosts, I have to include the host names in the search. I do have alert mode set to: "Once per Result". Is there something that can be changed so Splunk alerts if any of these hosts events show? As stated, we would like it to be one alert for each event. Should I change the search or do I need to set up alerting individually for each one? Any suggestions would be greatly appreciated. Thank you. ... View more

Has anyone run up against an issue where you're intermittently getting a "no results found" on any search in their environment? If so, were you able to determine what was causing the issue? As stated the issue is intermittent and to add to the complexity, I have noticed that one user may return results while another user cannot for the same search at the same time. (We are currently using SH pooling with 2 Searchheads). Nothing has been changed with the user roles prior to the issue surfacing and it has not been identified specifically to one or the other search heads. Any thoughts and/or areas to focus on would be greatly appreciated. Thank you. ... View more