Deployment Architecture

Data update to search head not on time.

reginali
New Member

I faced an question about data cannot update to search head real time. i created serveral local app folder on one windows client. and part of monitor logs updates to search head real time. part of monitor log data disappears in search head suddenly and after several hours it updates data again and can find all data before. And i checked the log updated real time but not updated to splunk real-time.

i wrote inputs.conf like this:

[monitor://\XAWSCSPLUNK\MIPC_Ping*.csv]
index = mxa_mipc_ping
sourcetype = mipcpinglog
ignoreOlderThan = 7d
crcSalt =

[monitor://\xawmodapp01\ModTrace\ModAutoSpooler\Trace*.txt]
index = mxa_mes_mod
sourcetype = xawmodapp01log
ignoreOlderThan = 7d
crcSalt =

Anyone know what should i do for that all log can upload real-time?

Labels (4)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!