Splunk Missing Syslog Events

dlems — Tue, 23 Nov 2010 06:20:05 GMT

Splunk is missing some of the events listed in my syslog file.

(Can't really believe this hasn't been asked. I searched but couldn't find. Possible match is http://answers.splunk.com/questions/9045/websphere-log-monitoring-missing-events, but it is also unanswered at this time.)

A small fraction of events recorded in the system log file are not found in searches. Single Splunk system (version 4.1.5), remote events are coming into syslog-ng, syslog-ng creates a single file - splunk-log.

Splunk search misses first entry below but finds second when looking for 15769:94.

(line 10047154)

Nov 22 10:46:57 192.168.1.53 '': INFO [OSAPI_PROD] [Access] Client [192.168.1.193] ReqID [15769:94] Serving request [getDHCPInfo] Args [clientIP=>192.168.1.193, macAddress=>00:06:7f:0c:ab:ff, requestID=>15769:94]

(line 10048270)

Nov 22 10:46:58 192.168.1.53 '': INFO [OSAPI_PROD] [Access] Client [192.168.1.193] ReqID [15769:94] Request [getDHCPInfo] completed in [0.599868] seconds :: Return Code [0]

The log file is 18467113 lines long, so it's not close to the end of the file. (Was thinking the file was rotated before Splunk had a chance to grab it, but this isn't the case.)

Any ideas why this is happening?

Re: Splunk Missing Syslog Events

jtrucks — Tue, 12 May 2015 15:10:41 GMT

If this is still a problem, open a support ticket and send in a drag report.

topic Splunk Missing Syslog Events in Getting Data In

Splunk Missing Syslog Events

Re: Splunk Missing Syslog Events