Event Breaking Issue

[bharathkumarnec]

Hi Everyone,

Need help regarding event breaking, below is my current scenario:

One my log file in the indexer is updating not updating the log in frequent intervals, for example:

Event starts with date in format "2015-10-01 07:31:09.733+0000" and this event will end writing data after 5min with 'n' number of lines, and next event will start with the same date format. The problem is as the log is taking 5min time to finish writing the event, splunk splitting one event into three or four different events.

Kindly help me out with this problem, let me know if more information is required.

Thanks in Advance

[woodcock · Accepted solution]

You can try using the time_before_close parameter inside inputs.conf and setting it to something like 300 but be sure to test it on one server/file first and if you decide to keep it, be sure it is only on these kinds of inputs because this will cause a 5-minute delay in getting events into Splunk.

[bharathkumarnec]

Thanks Woodcock, for your inputs!

[bharathkumarnec]

The usage of this parameter is working fine for me..Thanks!