Deployment Architecture

Data update to search head not on time.

New Member

I faced an question about data cannot update to search head real time. i created serveral local app folder on one windows client. and part of monitor logs updates to search head real time. part of monitor log data disappears in search head suddenly and after several hours it updates data again and can find all data before. And i checked the log updated real time but not updated to splunk real-time.

i wrote inputs.conf like this:

index = mxa_mipc_ping
sourcetype = mipcpinglog
ignoreOlderThan = 7d
crcSalt =

index = mxa_mes_mod
sourcetype = xawmodapp01log
ignoreOlderThan = 7d
crcSalt =

Anyone know what should i do for that all log can upload real-time?

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...