We have set up DB connect and DB inputs. We query databases and .dbmonevt files are created. The problem is that they are indexed with a delay of 20-30 minutes. We tried to add interval = 60 to [batch] in local inputs.conf but no luck.
How to change interval of batch processing?
I think you're missing the unit size on there, not sure that DBX 1.1.x will figure that out. http://docs.splunk.com/Documentation/DBX/1.1.7/DeployDBX/Configuredatabasemonitoring#Specify_input_q...