IIS log exceeded index amount

[cschafer1]

Hello,

We installed the splunk forwarder on a server doing about 134 meg log per day. Today it has done about 734 meg in the last 24hours...Log file as it sits is only about 140 meg

I am stumped we have forwarders working as designed.. We have standard conf files that we use..

If anyone has any suggestions on why the indexer amount ballooned to that amount? I can post conf files if any one as a feeling.

Thank you in advance.

Cory

[lukejadamec]

Can you post the inputs.conf for that monitor? How long has this been running? You said new, is it new new, or was new?

[jtrucks]

Run the following search to see what spiked (use a graphical chart to visualize it fast) and replace YOURHOSTNAME with the host in question:

index=_internal source=*license_usage.log type=Usage h=YOURHOSTNAME | eval MB=b/1024/1024 | timechart span=1d sum(MB) by s useother=false usenull=false

Do this across the last few days or week to get a good trend line on that host. This should point out exactly where to focus efforts because you'll know what source suddenly had more messages. Then you can look at that source to see what you might have that could cause such a spike. Usually it means that something broke (an app or hardware) that spewed tons of messages for a few hours.