https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262636#M189757 <P>I'm also interested in the behavior of this setting. Any update for us?</P> Thu, 05 Jan 2017 14:17:24 GMT dflodstrom 2017-01-05T14:17:24Z https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262632#M189753 <P>According to this blog post: <A href="http://blogs.splunk.com/2014/03/18/time-based-load-balancing/">http://blogs.splunk.com/2014/03/18/time-based-load-balancing/</A></P> <BLOCKQUOTE> <P>Using this setting Splunk can break<BR /> the data stream and reconstruct the<BR /> event properly on the indexer.</P> </BLOCKQUOTE> <P>That's pretty awesome. How exactly does this work when autoLB breaks the event and sends each segment to a different indexer? How do the indexers figure out where the other portion of the event is for reconstruction?</P> Fri, 15 Jul 2016 18:03:59 GMT https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262632#M189753 the_wolverine 2016-07-15T18:03:59Z https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262633#M189754 <P>The forwarder sends 64KB chunks of data to the indexer (no matter the events on it). When its forced to send data to a second indexer, it resends the last 64KB chunk again to the second indexer. So:<BR /> 1 - The first indexer it will index everything before the last event break and ignore the rest (to avoid indexing an incomplete event). <BR /> 2 - The second indexer will index the data after the last event break which will be complete by the following 64KB chunks data.</P> <P>This works ok if the events are smaller that 64KB.</P> Fri, 15 Jul 2016 18:26:58 GMT https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262633#M189754 diogofgm 2016-07-15T18:26:58Z https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262634#M189755 <P>We're seeing broken events so I'm not sure if it's working as expected.</P> Fri, 15 Jul 2016 20:22:40 GMT https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262634#M189755 the_wolverine 2016-07-15T20:22:40Z https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262635#M189756 <P>whats the size of your events? can you post a sample?</P> Tue, 19 Jul 2016 15:24:03 GMT https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262635#M189756 diogofgm 2016-07-19T15:24:03Z https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262636#M189757 <P>I'm also interested in the behavior of this setting. Any update for us?</P> Thu, 05 Jan 2017 14:17:24 GMT https://community.splunk.com/t5/Splunk-Search/How-does-Splunk-reconstruct-events-when-using/m-p/262636#M189757 dflodstrom 2017-01-05T14:17:24Z