topic Re: Event Breaking Issue in Getting Data In

Event Breaking Issue

bharathkumarnec — Thu, 01 Oct 2015 09:13:03 GMT

Hi Everyone,

Need help regarding event breaking, below is my current scenario:

One my log file in the indexer is updating not updating the log in frequent intervals, for example:

Event starts with date in format "2015-10-01 07:31:09.733+0000" and this event will end writing data after 5min with 'n' number of lines, and next event will start with the same date format. The problem is as the log is taking 5min time to finish writing the event, splunk splitting one event into three or four different events.

Kindly help me out with this problem, let me know if more information is required.

Thanks in Advance

Re: Event Breaking Issue

woodcock — Mon, 05 Oct 2015 17:58:46 GMT

You can try using the time_before_close parameter inside inputs.conf and setting it to something like 300 but be sure to test it on one server/file first and if you decide to keep it, be sure it is only on these kinds of inputs because this will cause a 5-minute delay in getting events into Splunk.

Re: Event Breaking Issue

bharathkumarnec — Tue, 06 Oct 2015 08:18:07 GMT

Thanks Woodcock, for your inputs!

Re: Event Breaking Issue

bharathkumarnec — Sat, 17 Oct 2015 20:04:24 GMT

The usage of this parameter is working fine for me..Thanks!