Why is the last syslog event coming in from a universal forwarder not getting indexed?

[jaffaradmin]

Hi,

We have a scenario where the Splunk is not indexing the last event received via syslog. The search results are always n-1 where if I have to get the last event, I need to generate one more event. Mostly cisco syslog and linux syslog are affected by this. In the data summary, it shows that there is a latest event, but when the search is run, it doesn't show the latest event, but shows the previous one as the latest. The syslogs are coming through universal forwarder. Have tried sending them directly to the indexer and still the same issue. Has anyone come across such issues? Please let us know.

[jwelch_splunk]

This problem is most likely related to your props.conf
You need to make sure you have:
SHOULD_LINEMERGE=false

Use btool to ensure this is the case for this data.

[delalegro]

Thanks man! This fixed my problem with iDRAC 7 syslog events.

[pmerlin1]

Hi folks,

I meet the same issue with another source type. The last event is never show in result search until another event is indexed. Someone can help me please ?