Splunk did not read uploaded file into Splunk GUI until the end

Azwaliyana — Tue, 21 Dec 2021 08:56:13 GMT

I have a text file that has 8824 lines. I have configured MAX_EVENT= 1000. Then, Splunk only read the file until line 7599. Why Splunk did not read my file till the end of file? Is there anything that I need to configure?

It is a health check file. This is my

BREAK_ONLY_BEFORE = CIC: Node IP Address|Service Status:|\-{10}|\={12}|Summary:|Memory Details on

Re: Splunk did not read uploaded file into Splunk GUI until the end

aasabatini — Tue, 21 Dec 2021 15:38:24 GMT

Hi @Azwaliyana

try to use on your input stanza this command

crcSalt = <SOURCE>

topic Re: Splunk did not read uploaded file into Splunk GUI until the end in Splunk Enterprise

Splunk did not read uploaded file into Splunk GUI until the end

Re: Splunk did not read uploaded file into Splunk GUI until the end