Perfect thanks 🙂 ... View more

ok cheers for your help ... View more

Hi I have new information on this file, it it created and re created at a high rate. This could be causing the issue right? But splunk should be able to handle it and not cause issues on the service we are monitoring. In the end i have added it to a black list as we dont need the file Thanks Rob ... View more

When we stop Splunk forwarder it works, when we restart Splunk forwarders we get this error. To me the machine is low is something, but i dont know what. ... View more

perfect thanks 🙂 ... View more

ok- cheers and thanks ... View more

did you get this to work in the end? ... View more

Yes this file keeps getting re-written (in parts) , so splunk keeps having to re-read it over and over. all other files append, this was the one that does not thanks rob ... View more

Hi This was the answer, can you post it and i will accept it please. The file we deleting parts of it self and Splunk had to keep taking it in again and again. Rob ... View more

Hi We removed the /net and it reduced by 30% also we removed some unwanted file we were monitoring as well. We might have to move to a dedicated machine, this is a bit annoying as people often ask me what is the impact of Splunk and the "Nice answer" is very small, but in this case its hight...hmmm Cheers for the help Rob ... View more

Hi I cant use batch mode as other services needed the files after Splunk has read them in (Batch mode will delete the files right?). We also have a lot of files and this could be causing the issue!!! The forwarder is installed on machine dell479srv - perhaps we don't need to to use /net/ perhaps this is causing an issue. [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/monitoring.../jmap*] disabled = false host = MxOne_Testing_Latest index = mlc_live whitelist=.*.log$ sourcetype = jmap crcSalt = blacklist=logs_|fixing_|tps-archives ... View more

linputs.conf [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs.../*.json] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = reset_profiler crcSalt = blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs.../*.log] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = sun_jvm crcSalt = <SOURCE> whitelist = .*gc\.log$|.*gc.*\.log$ blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT.../*.tps] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = tps crcSalt = <SOURCE> whitelist = .*\.tps$ blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/monitoring/vmstat/*.log] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = vmstat-linux crcSalt = <SOURCE> whitelist = vmstat.*\.log$ blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/monitoring/nicstat/*] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = nicstat crcSalt = <SOURCE> whitelist = nicstat.*\.log$ blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/monitoring/*] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = mx_version crcSalt = <SOURCE> whitelist = mx_version_.*$ blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/monitoring/mlc_version/*] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = mlc-version crcSalt = <SOURCE> whitelist = mlc_version_.*$ blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/*] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = murex_log4j whitelist = .*\.log$ crcSalt = <SOURCE> blacklist=logs_|fixing_|tps-archives|errors.log|.*gc\.log$|.*gc.*\.log$ [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT.../*.log] disabled = false host = MxOne_Testing_Latest index = mlc_live whitelist=mxtiming.*\.log$ blacklist=logs_|fixing_|tps-archives|mxtiming_crv_nr.* crcSalt = <SOURCE> sourcetype = MX_TIMING2 [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT.../*service.log] disabled = false host = MxOne_Testing_Latest index = mlc_live whitelist = (?<NPID>\d*)-\d*-service\.log blacklist=logs_|fixing_|tps-archives crcSalt = <SOURCE> sourcetype = service [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/*_CheckToolLifeCycle.txt] disabled = false host = MxOne_Testing_Latest index = mlc_live sourcetype = tool_lifecycle crcSalt = <SOURCE> blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/monitoring.../jmap*] disabled = false host = MxOne_Testing_Latest index = mlc_live whitelist=.*\.log$ sourcetype = jmap crcSalt = <SOURCE> blacklist=logs_|fixing_|tps-archives [monitor:///net/dell479srv/dell479srv2/apps/TheOne-RSAT/logs/monitoring.../jstack*] disabled = false host = MxOne_Testing_Latest index = mlc_live whitelist=.*\.log$ sourcetype = jstack crcSalt = <SOURCE> blacklist=logs_|fixing_|tps-archives props.conf [splunkd] EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+-]\d+ )?(?P[^ ]*)\s+(?P[^ ]+) - (?P.+) [splunk_web_service] EXTRACT-useragent = userAgent=(?P[^ (]+) ... View more

I have the same issues, do you find a solution ... View more

THanks for your help woodcock, it has helped me to understand them better. 🙂 ... View more

HI Skoelpin, sorry for the delay. I was pulled away for a few days there. I understand the issues now. My main objective is to stop the user getting a blank screen [This happens if summariesonly=true and the data is not summarized]. What i am going to do is the following. When a new log drop is uploaded i can get the time of upload T I will minus now() when the user click to see there data. IF greater then 5m i will set the token of summariesonly=false is less then 5 minutes summariesonly=true. This way the user will always see data and we can use both techniques. THanks for the help Rob.. ... View more

Can i reduce the 5 minutes to 1 minutes, is there a prop for that? ... View more