We setup Splunk to monitor log files and generate alerts on abnormal situations. Log files are recording all activities done from open up of Excel reports, processing, file save and close. There are more than 500 Excel files to be handled daily.
Recently, false alarm were triggered. After investigation, we found not all transaction lines in the log files can be found from Splunk. Sometime, a few lines from the beginning of one or two log files will not show in Splunk. And sometime, a few lines at the end of the log files will not show.
Can Splunk or super users here can give advice or even solution ?