Getting Data In

What do we do if our UDP events are being delayed?

sdubey_splunk
Splunk Employee
Splunk Employee

We are experiencing a delayed indexing of UDP events.

Environment: UF -> Indexer.

Event1 was sent to indexer(confirmed via tcpdump that the messages are sent successfully to indexer).

Event2 was sent after 4 hours and only then was Event1 visible via search and Event2 searchable. Then, after that, Event3 is sent. So in short there is delay in indexing.

Already tried: props.conf

[devservers]
TRANSFORMS-index = hosts
SHOULD_LINEMERGE = false
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^

2.Also tried updating props.conf (Event had date twice in the event)
BREAK_ONLY_BEFORE_DATE

How do we fix this issue?

Tags (2)
0 Karma
1 Solution

sdubey_splunk
Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

View solution in original post

0 Karma

sdubey_splunk
Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...