Getting Data In

What do we do if our UDP events are being delayed?

Splunk Employee
Splunk Employee

We are experiencing a delayed indexing of UDP events.

Environment: UF -> Indexer.

Event1 was sent to indexer(confirmed via tcpdump that the messages are sent successfully to indexer).

Event2 was sent after 4 hours and only then was Event1 visible via search and Event2 searchable. Then, after that, Event3 is sent. So in short there is delay in indexing.

Already tried: props.conf

[devservers]
TRANSFORMS-index = hosts
SHOULDLINEMERGE = false
TIME
FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^

2.Also tried updating props.conf (Event had date twice in the event)
BREAKONLYBEFORE_DATE

How do we fix this issue?

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

View solution in original post

0 Karma