Hi, I have an index in wich I collect a lot of data, approximately 40 Gb/day. In the indexes.conf, I guess I've made a mistake and configured : maxDataSize = auto Now, it looks like I'm loosing data older than 3 month (roughly) and I guess it's due to this parameter. In the documentation (I should have read it before !), I can see for maxDataSize : "You should use "auto_high_volume" for high-volume indexes ... A "high volume index" would typically be considered one that gets over 10GB of data per day." 1/ Is it possible to change this parameter for an existing index ? Obviously, regarding the volume I want to ingest, the "auto_high_volume" is more appropriate (==> "maxDataSize = auto_high_volume" in the indexes.conf) 2/ Is there any other reason why I am losing data ? Thanks for your help ! David ... View more

Hi experts, I'm collecting logs wich look like this : 2019-12-18_09:51:42.982 [] [req-] INFO ParGideBS.getByCle bulletinDispatch.timeout 0ms 2019-12-18_09:51:42.983 [] [req-] INFO ParGideBS.getByCle bulletinDispatch.timeout 0ms 2019-12-18_09:51:42.984 [] [req-] INFO AttributionBullBS.findAllBullDispatchD1EtD2 bulletinDispatch.timeout 1ms 2019-12-18_09:51:42.985 [] [req-] INFO AttributionBullBS.findAllBullDispatchDiv bulletinDispatch.timeout 1ms 2019-12-18_09:51:42.987 [] [req-] INFO AttributionBullBS.findAllBullDispatchCtrl bulletinDispatch.timeout 1ms 2019-12-18_09:51:42.981 [] [req-] INFO ParGideBS.getByCle bulletinDispatch.timeout 1ms 2019-12-18_09:51:32.557 [] [req-] INFO ParamGideBS.getByCle bulletinDispatch.timeout 0ms 2019-12-18_09:51:32.557 [] [req-] INFO ParamGideBS.getByCle bulletinDispatch.timeout 0ms 2019-12-18_09:51:32.558 [] [req-] INFO AttributionBullBS.findAllBullDispatchD1EtD2 bulletinDispatch.timeout 0ms 2019-12-18_09:51:32.559 [] [req-] INFO AttributionBullBS.findAllBullDispatchDiv bulletinDispatch.timeout 0ms 2019-12-18_09:51:32.560 [] [req-] INFO AttributionBullBS.findAllBullDispatchCtrl bulletinDispatch.timeout 0ms With this file, I'd like splunk to do a very simple thing : create 1 event for each line, but... I can't do it. I tried these parameters in props.conf : SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE_DATE = true TIME_FORMAT=%Y-%m-%d_%H:%M:%S.%3N TIME_PREFIX=^ or even : SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) or : BREAK_ONLY_BEFORE = ^ All these parameters work well when I test the file using the "add data" feature in Splunk web... BUT... it doesn't work when I push the prop.conf file in my production environment. In the example above, Splunk merge the 5th first lines in 1 event, then I have one line in an event and the last 5 lines in another event : it seems that Splunk organize the parsing with the blank lines in the file (= lines between 2 blank line are grouped in the same event). Could someone help me on this case and provided the "magic" props to solve it ? Many thanks David ... View more

Hi Splunkers, I have to upgrade a production environment : - 6.6.1 to 7.2 - Linux - 1 index master, 2 nodes, 1 search-head I first tried to upgrade a test environment (very little data) and the operation was very quick. OK. Now, my production environment contains much more data : approx. 3 or 4 Tb... maybe more. Could someone tell me if the upgrade duration depend on the volume of data ? So in my case, the production upgrade will last much longer ? Thanks ! David ... View more