https://community.splunk.com/t5/Getting-Data-In/clearing-buffered-events/m-p/46165#M8697 <P>We have a system where the log rotation confuses splunk and splunk starts attempting to reindex the log. This happened 3 days ago and we Splunk is still trying to catch up. How can I clear the "buffer" and just tell splunk to start from this point forward? I think the throughput is saturated and it is sending as many events it can. When the problem started, we were getting about 9400 duplicate events per 1 event. We are now at about 50 to 1. Any ideas on how to make this stop?</P> Tue, 08 May 2012 19:13:12 GMT mcbradford 2012-05-08T19:13:12Z https://community.splunk.com/t5/Getting-Data-In/clearing-buffered-events/m-p/46165#M8697 <P>We have a system where the log rotation confuses splunk and splunk starts attempting to reindex the log. This happened 3 days ago and we Splunk is still trying to catch up. How can I clear the "buffer" and just tell splunk to start from this point forward? I think the throughput is saturated and it is sending as many events it can. When the problem started, we were getting about 9400 duplicate events per 1 event. We are now at about 50 to 1. Any ideas on how to make this stop?</P> Tue, 08 May 2012 19:13:12 GMT https://community.splunk.com/t5/Getting-Data-In/clearing-buffered-events/m-p/46165#M8697 mcbradford 2012-05-08T19:13:12Z https://community.splunk.com/t5/Getting-Data-In/clearing-buffered-events/m-p/46166#M8698 <P>There are probably several possible reasons for why this is happening, but it's hard to tell from the limited information. </P> <P>Have you tried playing with the <CODE>ignoreOlderThan</CODE> and <CODE>followTail</CODE> parameters for <CODE>inputs.conf</CODE>?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></P> <P>/Kristian</P> Tue, 08 May 2012 19:26:15 GMT https://community.splunk.com/t5/Getting-Data-In/clearing-buffered-events/m-p/46166#M8698 kristian_kolb 2012-05-08T19:26:15Z