I found that official documentation mention like below. The dispatch directory reaper iterates over all of the artifacts every 30 seconds. The reaper deletes artifacts that have expired based, on the last time that the artifacts were accessed and their configured time to live (TTL), or lifetime. ... View more

The following Answer mentioned the truth of this. *Actually this is old information, but maybe moves of real-time search have not changed. https://answers.splunk.com/answers/342271/alerts-triggering-continuously.html ... View more

If you set it to NON, I think that there is a possibility that it will be set from the update time of the file. Excerpt from ”Timestamp extraction configuration” "CURRENT" will set the time of the event to the time that the event was merged from lines, or worded differently, the time it passed through the aggregator processor. "NONE" will leave the event time set to whatever time was selected by the input layer For data sent by splunk forwarders over the splunk protocol, the input layer will be the time that was selected on the forwarder by its input behavior (as below). For file-based inputs (monitor, batch) the time chosen will be the modification timestamp on the file being read. For other inputs, the time chosen will be the current system time when the event is read from the pipe/socket/etc. Both "CURRENT" and "NONE" explicitly disable the per-text timestamp identification, so the default event boundary detection (BREAK_ONLY_BEFORE_DATE = true) is likely to not work as desired. When using these settings, use SHOULD_LINEMERGE and/or the BREAK_ONLY_* , MUST_BREAK_* settings to control event merging. ... View more

I received information about these logs from Splunk support team. django_access.log django_error.log django_service.log These logs have been deprecated (outdated) since 6.3 version and is not longer used python.log Settings of this log is hard coded and cannot be modified. max file size:25MB maintain copies:5 splunkd_stderr.log splunkd_stdout.log Settings of these logs are described in below manual https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Serverconf#Log_rotation_of_splunkd_stderr.log_.26_splunkd_stdout.log max file size:10MB maintain copies:2 web_access.log web_service.log Settings of these logs are described in below manual https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Webconf max file size:25MB maintain copies:5 ... View more

Splunk support said that it is maybe bug. And they opened this case as "SPL-149077" and they were investigating about it. The cause of this problem is to add "/" at the end of the path when setting "coldToFrozenDir". So, workaround is to always avoid appendding "/" at last of the path when specifying the path. additional information Splunk support said that this bug will be fixed in ver 6.6.7 and 7.0.3. ... View more

It is known issue of Splunk 6.2.0 SPL-93063 "Index list is incomplete under Input Settings, not all index names display." https://docs.splunk.com/Documentation/Splunk/6.2.0/ReleaseNotes/KnownIssues ... View more