Hi, I am trying to correlate two different source types (haproxy and apache). I would like to find the access on haproxy for the error I have on apache. Here are the 2 queries I want to correlate: Query 1 on apache: index=* host=hostB sourcetype=apache_error "interesting error" earliest=@d-3d latest=now Query 2 on haproxy: index=* host=hostA sourcetype=haproxy "interesting access" So, I am looking to find the access on the haproxy when the interesting error happened on the apache. I tried something like that but without success: index=* host=hostA sourcetype=haproxy "interessting access" | search [search index=* host=hostB sourcetype=apache_error "interesting error" | eval earliest=relative_time(_time, "@m") | eval latest=relative_time(_time, "@m")+1 | return field1 field2 field3 ] | table _time host _raw field1 field2 field3 I can't find any solutions to correlate those source types without any correlation field. Could you help me on that ? ... View more

Hi, We are actually monitoring our application log file with a forwarder configured like that: [monitor:///var/log/application/application.*] sourcetype = log4j index = application This application manage the log with log4j to put in a file like that: <RollingFile name="LOG_FILE" fileName="/var/log/application/application.log" filePattern="/var/log/application/application.log.%i" append="true"> <Policies> <SizeBasedTriggeringPolicy size="20MB" /> </Policies> <DefaultRolloverStrategy max="10" /> </RollingFile> But our application is really verbose, for example, today we have those files: -rw-r-----. 1 weblogic weblogics 19223378 Apr 9 10:43 application.log -rw-r-----. 1 weblogic weblogics 20976777 Apr 9 03:06 application.log.1 -rw-r-----. 1 weblogic weblogics 20971660 Apr 9 04:00 application.log.2 -rw-r-----. 1 weblogic weblogics 20972962 Apr 9 04:50 application.log.3 -rw-r-----. 1 weblogic weblogics 20971633 Apr 9 05:40 application.log.4 -rw-r-----. 1 weblogic weblogics 20971950 Apr 9 06:29 application.log.5 -rw-r-----. 1 weblogic weblogics 20971611 Apr 9 07:17 application.log.6 -rw-r-----. 1 weblogic weblogics 20971535 Apr 9 08:03 application.log.7 -rw-r-----. 1 weblogic weblogics 20972289 Apr 9 08:53 application.log.8 -rw-r-----. 1 weblogic weblogics 20971526 Apr 9 09:37 application.log.9 -rw-r-----. 1 weblogic weblogics 20971784 Apr 9 10:14 application.log.10 And this introduces a delay on when the log are available on Splunk after the rotation, you can see below a grph with the count of event in the sourcetype base on the indextime: Do you know a solution to handle that without this delay ? I don't think that configure log4j to log in bigger file will fix that. Thank you for your help ... View more