https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226751#M44276 <P>I started seeing massive delays (5+ minutes, sometimes 10) after upgrading to 6.3.0 (Also having this problem is 6.3.1). I have about 60 UNC paths that I'm monitoring.</P> <P>Changing to use the Universal Forwarder on the source of the logs worked around the massive delay problem for us,</P> Fri, 13 Nov 2015 18:04:27 GMT JeffSchumacher 2015-11-13T18:04:27Z https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226750#M44275 <P>Hello and good morning,</P> <P>I have a heavy forwarder that takes inputs from several network drives and it's working fine so far.</P> <P>The question I can't find an answer to in the Splunk docs is, is getting data from network drives best practice?</P> <P>The thing is, I have performance problems. The data is indexed with a delay and I'm trying to figure out if maybe the network drives have a part in that.</P> <P>Any assistance on this would be greatly appreciated. A link to a Splunk doc would be perfect.</P> <P>Thank you </P> Fri, 13 Nov 2015 08:01:48 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226750#M44275 dkeck 2015-11-13T08:01:48Z https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226751#M44276 <P>I started seeing massive delays (5+ minutes, sometimes 10) after upgrading to 6.3.0 (Also having this problem is 6.3.1). I have about 60 UNC paths that I'm monitoring.</P> <P>Changing to use the Universal Forwarder on the source of the logs worked around the massive delay problem for us,</P> Fri, 13 Nov 2015 18:04:27 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226751#M44276 JeffSchumacher 2015-11-13T18:04:27Z https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226752#M44277 <P>Thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I found a different failure, repsonsible for the delay. Thank you very much anyway.</P> <P>Several Servers in the outputs.conf where not reachable, so splunk retried all the time.</P> Mon, 16 Nov 2015 06:46:50 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226752#M44277 dkeck 2015-11-16T06:46:50Z https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226753#M44278 <P>I would like to except your answer..but theres not button for it...sry</P> Mon, 16 Nov 2015 06:54:09 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-best-practice-to-collect-data-from-network-drives-using-a/m-p/226753#M44278 dkeck 2015-11-16T06:54:09Z