I choosed a path on the splunk server as source. This path includes 2 logfiles I want to check. They gonna refresh every hour. That works really good without problems. I changed nothing on the system since a week. What do you mean with single line? Which event? Do you mean the logfile entries? They are single lines yes. Timestamp format is since the begin in every logfile 2017/03/23 11:00:44.978 Modified example of the logfile: /path/to/logfile/processname.log.log:2017/03/23 11:00:07.084 ERROR: errormessage {function} /path/to/logfile/processname.log.log:2017/03/23 11:00:10.409 ERROR: errormessage occured during run {function} /path/to/logfile/processname.log.log:2017/03/23 11:00:12.115 ERROR: errormessage {function} /path/to/logfile/processname.log.log:2017/03/23 11:00:14.610 ERROR: NoRecordsFoundException: null {function} /path/to/logfile/processname.log.log:2017/03/23 11:00:18.290 ERROR: errormessage {function} /path/to/logfile/processname.log.log:2017/03/23 11:00:19.833 ERROR: errormessage {function} ... View more

Its an normal text logfile. At this point I collect the information into one file and push this with scp on the splunk server. The configuration and the whole system work 3 weeks really well. I have this problem since 2017/03/21... ... View more

UPDATE: Now the logfile on the webinterface has the same changedate as the last entry in the logfile. The problem is just that there are new logfiles on the server, but splunk doesnt recognize it. ... View more

Damn you are good. Thats great and exactly doing what I have in my mind. Thanks!! ... View more

It's me again. Your answer helps me a lot and did exactly what i want. Thank you for that. I thought about a history about the last 7 days (for every day one line). And found this question: https://answers.splunk.com/answers/239649/need-to-get-stats-count-by-day.html They used "bucket _time span=day" to separate the day. Do you know how I implement this? I tried: <SEARCH> | bucket date span=day | eventstats count(errormessage) as FullCount | stats dc(machine) as UniqueCount last(FullCount) as FullCount | eval ratio=round(FullCount/UniqueCount,2) but it doesn't work. The field "16/02/2017" is calling date. I do my best and start searching again but maybe you can help me again. Thanks so much. ... View more

Wow. That works perfectly. Thanks so much 🙂 ... View more