Splunk ignores similar lines in an event

crobicha — Tue, 08 Nov 2011 14:22:36 GMT

This seems to be a similar problem as what is happening in my other question, but it seems different enough to create a separate thread.

We have a server process running that dumps log data out every 5 minutes to a single file, which is splunk indexed. We track stats whenever certain requests are made and write to the log in the format:

METHOD=[method name] COUNT=[number of times this method was called in last 5 min] LENGTH=[cumulative time spent on this method in the last 5 min]

The problem is that (similar to the other thread) only the first method in each event is showing up when I do a search, for example:

source="stats.log" "METHOD" | table METHOD LENGTH COUNT

shows only the first method in that log repeated over and over again, and ignores any after the first one.

Re: Splunk ignores similar lines in an event

tgow — Tue, 08 Nov 2011 19:10:04 GMT

Without seeing more lines of your logfile does this search help:

source="stats.log" METHOD="*" | table METHOD, LENGTH, COUNT

topic Re: Splunk ignores similar lines in an event in Getting Data In

Splunk ignores similar lines in an event

Re: Splunk ignores similar lines in an event