I’m new to Splunk, and running with the trial licence exactly as it comes out of the box (no fancy config etc.). i.e. Single instance combining search and indexing, on Windows 7. Using the downloaded sample data, I see that by inputting the same data file repeatedly, I get a different number of events indexed each time. So: First I input a file which resulted in 21065 events indexed. (For info this was the apache3.splunk.com/access_combined.log from the sample data). I input the same file again, using a different host value, and got 26776 events on the summary. Further loads (each with different host value) gave 26693 , 27888 and 24210 events. Each input (except one - see CLUE below) seems to be associated with one or more “ERROR HTTPServer - InputStreamConduit write timed out after 5 seconds.” in Splunkd.log . Can anyone help explain this? CLUE 1: There were no errors in Splunkd.log at the time of the input which resulted in 27888 events. CLUE 2: From inspecting the input file myself I’d say it contains 27705 events. CLUE 3: I'm getting similar problem with a different file (apache2) of about the same size. But not with the apache1 sample file which is smaller (9199 events each time consistently) Thanks for any help! Rick ... View more