topic Re: Why is the last syslog event coming in from a universal forwarder not getting indexed? in Getting Data In

Why is the last syslog event coming in from a universal forwarder not getting indexed?

jaffaradmin — Tue, 24 Nov 2015 12:24:10 GMT

Hi,

We have a scenario where the Splunk is not indexing the last event received via syslog. The search results are always n-1 where if I have to get the last event, I need to generate one more event. Mostly cisco syslog and linux syslog are affected by this. In the data summary, it shows that there is a latest event, but when the search is run, it doesn't show the latest event, but shows the previous one as the latest. The syslogs are coming through universal forwarder. Have tried sending them directly to the indexer and still the same issue. Has anyone come across such issues? Please let us know.

Re: Why is the last syslog event coming in from a universal forwarder not getting indexed?

pmerlin1 — Thu, 20 Oct 2016 14:55:32 GMT

Hi folks,

I meet the same issue with another source type. The last event is never show in result search until another event is indexed. Someone can help me please ?

Re: Why is the last syslog event coming in from a universal forwarder not getting indexed?

jwelch_splunk — Thu, 27 Oct 2016 02:22:56 GMT

This problem is most likely related to your props.conf
You need to make sure you have:
SHOULD_LINEMERGE=false

Use btool to ensure this is the case for this data.

Re: Why is the last syslog event coming in from a universal forwarder not getting indexed?

delalegro — Wed, 25 Oct 2017 15:04:29 GMT

Thanks man! This fixed my problem with iDRAC 7 syslog events.