Hello, I have a log file that is being indexed and many of the lines show up combined into multi-line events however there seems to be no logic behind the combining. Each line has a timestamp yet they are being combined regardless. I have no props.conf in this config - therefore I assume default line merging is in effect. Example log data: 08:26:53,465 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap 08:26:53,561 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap 08:26:53,699 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap 08:26:53,765 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap 08:26:59,234 WARN [org.alfresco.repo.cache.TransactionalCache.org.alfresco.cache.avmNodeTransactionalCache] Transactional update cache 'org.alfresco.cache.avmNodeTransactionalCache' is full (5000). 08:27:05,532 WARN [org.alfresco.repo.cache.TransactionalCache.org.alfresco.cache.contentDataTransactionalCache] Transactional update cache 'org.alfresco.cache.contentDataTransactionalCache' is full (1000). 08:27:23,223 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap 08:27:23,961 WARN [com.sap.ca.alfresco.base.repo.importer.SapImporterBootstrap] Skiping bootstrap 08:27:23,962 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'OOoDirect' subsystem, ID: [OOoDirect, default] 08:27:23,988 INFO [org.alfresco.config.FixedPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/version.properties] Result The result is some of the lines are combined to multi-line and some are not but I cannot distinguish what is causing the combining/breaking. Question Is it possible to configure a regex to recognize the timestamp on the new line and then use props.conf to further configure the line breaking? Thanks, John ... View more

In my indexes I set maxTotalDataSizeMB = 8000 However, today my 18GB volume was full. I looked in the defaultdb directory and all of the files in the hot buckets were consuming all of the disk space. There was nothing located in warm/cold/frozen locations as I would have expected from reading the documentation on managing indexes/disk. I manually deleted defaultdb/db/hot* and it freed up 15+ GB. Can someone please explain why this does not seem to be working as expected or is there something else to check? Thanks, John ... View more

Hi, I am trying to override the default hostname that is being set for the syslog entries on /var/log/messages. These are the only entries that are being indexed with 'hostname' instead of 'hostname.fqdn' I have tried the following:    $SPLUNKHOME/etc/system/local/props.conf:       [syslog]       TRANSFORMS = RESULT: No difference    $SPLUNKHOME/etc/system/local/props.conf:      [source::/var/log/messages]      # note: overriding default syslog transform!      TRANSFORMS = something    $SPLUNKHOME/etc/system/local/transforms.conf      [something]      DEST_KEY = MetaData:Host      REGEX = .      FORMAT = host::hostname.fqdn RESULT: No difference Am I missing something? Thanks, John ... View more