We have a server running in Japan timezone. Recently when we did not find logs during a live testing.
Next day we ran the query to calculate delta between indextime and event time --- eval delta=_...
...reation, or when I restart Splunk instance, the index size decreases to nearly half of the max index size.
Is there any idea of why there is so significant delay for Splunk purging old events? a...
...hat any previous events that were sent between 8:00 and 9:00 are not sent again.
Is it best to use the index time rather than extract the time from the event during indexing?
Is there a way to a...
...indextime but never found latency more than 20 minutes
index=proofpoint source=proofpoint_message_log
| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")
| eval delay=_...
We are experiencing a delayed indexing of UDP events.
Environment: UF -> Indexer.
Event1 was sent to indexer(confirmed via tcpdump that the messages are sent successfully to indexer).
Event...
We have set up a Splunk forwarder to forward the latest logs in the same server, but we are having an issue where there is a huge difference between indexed time and the event time. I can see the delay...
Hi ,
I want to generate an indexing latency for a particular incoming event type.
Is it possible ?
I want a delay of a few minutes between the time the event is sent and the event is index...
...or some reason there's a huge delay between eventindexing and event creation time, still receiving logs that are 3 months old and new logs are getting delayed. What can be a reason for such a delay...
Hello all,
I have 4 SH, 2 indexer's, 1 Deployment Server in one of my environments (windows).
I'm now noticing that there's a long delay in some of my data showing up when searched on. This i...