Getting Data In
Highlighted

Splunk ignores similar lines in an event

Explorer

This seems to be a similar problem as what is happening in my other question, but it seems different enough to create a separate thread.

We have a server process running that dumps log data out every 5 minutes to a single file, which is splunk indexed. We track stats whenever certain requests are made and write to the log in the format:

METHOD=[method name] COUNT=[number of times this method was called in last 5 min] LENGTH=[cumulative time spent on this method in the last 5 min]

The problem is that (similar to the other thread) only the first method in each event is showing up when I do a search, for example:

source="stats.log" "METHOD" | table METHOD LENGTH COUNT

shows only the first method in that log repeated over and over again, and ignores any after the first one.

Tags (2)
0 Karma
Highlighted

Re: Splunk ignores similar lines in an event

Splunk Employee
Splunk Employee

Without seeing more lines of your logfile does this search help:

source="stats.log" METHOD="*" | table METHOD, LENGTH, COUNT
0 Karma