Getting Data In

What do we do if our UDP events are being delayed?

sdubey_splunk
Splunk Employee
Splunk Employee

We are experiencing a delayed indexing of UDP events.

Environment: UF -> Indexer.

Event1 was sent to indexer(confirmed via tcpdump that the messages are sent successfully to indexer).

Event2 was sent after 4 hours and only then was Event1 visible via search and Event2 searchable. Then, after that, Event3 is sent. So in short there is delay in indexing.

Already tried: props.conf

[devservers]
TRANSFORMS-index = hosts
SHOULD_LINEMERGE = false
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^

2.Also tried updating props.conf (Event had date twice in the event)
BREAK_ONLY_BEFORE_DATE

How do we fix this issue?

Tags (2)
0 Karma
1 Solution

sdubey_splunk
Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

View solution in original post

0 Karma

sdubey_splunk
Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...