Getting Data In

Why is the last syslog event coming in from a universal forwarder not getting indexed?

jaffaradmin
New Member

Hi,

We have a scenario where the Splunk is not indexing the last event received via syslog. The search results are always n-1 where if I have to get the last event, I need to generate one more event. Mostly cisco syslog and linux syslog are affected by this. In the data summary, it shows that there is a latest event, but when the search is run, it doesn't show the latest event, but shows the previous one as the latest. The syslogs are coming through universal forwarder. Have tried sending them directly to the indexer and still the same issue. Has anyone come across such issues? Please let us know.

0 Karma

jwelch_splunk
Splunk Employee
Splunk Employee

This problem is most likely related to your props.conf
You need to make sure you have:
SHOULD_LINEMERGE=false

Use btool to ensure this is the case for this data.

delalegro
Engager

Thanks man! This fixed my problem with iDRAC 7 syslog events.

0 Karma

pmerlin1
Path Finder

Hi folks,

I meet the same issue with another source type. The last event is never show in result search until another event is indexed. Someone can help me please ?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.