Hi Musskopf, These 2 issues have been fixed in DB connect 1.1.5. Please upgrade to get them fixed. By default in 1.1.5, jbridge.log will be rotated if larger then 100MB and max 5 history files. To change the settings, you still need to create jbridge_server.conf in $SPLUNK_HOME/etc/apps/dbx/local Please refer to http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Troubleshoot#Java_bridge_log_file_settings Hope this helps. ... View more

這是因為RFC-3164的限制，在 Splunk 6.2 之後已經依據RFC-5424修正，可以轉發超過1024 bytes的事件了。(SPL-88144) 另外要注意的是在outputs.conf 新增了 maxEventSize 參數，預設值仍為1024，請適當的增加這個值: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf maxEventSize = (integer) If specified, sets the maximum size of an event that splunk will transmit. All events excedding this size will be truncated. * Defaults to 1024 bytes. ... View more

Hi Justin, DB connect stores dbmon-tail, dbmon-dump events to files named *.dbmonevt and indexed by batch setting in dbx inputs.conf. The meta data such as host, sourcetype is stored in first line of *dbmonevt which needs props.conf to help on parsing to the right sourcetype, host, ...etc. The root cause of this issue should be props.conf is not properly parsed. Please check if it's really configured as a heavy forwarder or light weight forwarder. If it's light weight forwarder, you may be able to fix this issue by installing db connect app in the indexer for parsing *.dbmonevt. ... View more

Hi Bruce, You can reset the persistent states to have everything back to the initial state by referring to this answer: http://answers.splunk.com/answers/68572/splunk-db-connect-how-to-reset-tail-rising-state.html ... View more

Please try to increase MAX_DAYS_AGO in props.conf. Here is the answer you can refer to: http://answers.splunk.com/answers/24668/how-do-you-limit-the-amount-of-time-that-splunk-looks-into-the-past-for-log-data ... View more

The root cause should be MAX_TIMESTAMP_LOOKAHEAD = 20. The total length of the time stamp in the event is 26, to identify microsecond correctly, you should set: MAX_TIMESTAMP_LOOKAHEAD = 26 In this way, this issue should be resolved in 6.0 and the correct microsecond will be shown in 4.x and 5.x. ... View more

Please increase max_events_per_bucket in limits.conf: [search] max_events_per_bucket = 1000 Here is the description in document http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf: For searches with status_buckets>1 (i.e. Timeline), this setting will specify the maximum number of events to store per timeline bucket. Defaults to 1000 in code. (limits.conf in default will override to 10000 for 4.3.x until 5.0 to maintain existing behavior until the next major release) ... View more

These values were changed because in 5.x and beyond, search jobs started from the UI can now be queued when the search concurrency limit is reached instead of being refused. The back-end (splunkd) had this capability since 4.2, but the UI can only handle queued jobs since 5.0. The bottom line is that in 5.x, the maximum number of concurrent searches has been lowered but it should be compensated by the full implementation of search job queueing. Overall, the goal is to improve the search experience on systems with high search concurrency: your search might get queued up for a bit (ideally, no more than a few seconds) but it should run faster when launched as there will be fewer searches contending for the same resources (most notably, disk I/O). Further reading on this topic: Accommodate concurrent users and searches How saved searches affect Splunk performance ... View more