Hi every hour new file will be created with new name -rw-------. 1 splunk splunk   16062 Nov 30 21:57 2020-11-30-21.log -rw-------. 1 splunk splunk   11547 Nov 30 22:53 2020-11-30-22.log -rw-------. 1 splunk splunk    8192 Nov 30 23:55 2020-11-30-23.log. Mean while I got a message from splunk which states that HF disk space is getting full. please see the attached photo of the message       ... View more

yes you are right.i can see logs getting generated every hour in cd /syslog.but not getting those events in the search head.I have checked the inputs.conf file.not able to find any issue   below is the inputs.conf    [monitor:///syslog/websense_dlp/shared/.../*.log] disabled = false sourcetype = websense:dlp:system:cef host_segment = 4 index = websense-dlp_sec crcSalt = <SOURCE> ... View more

@gcusello Thanks for your reply. In our case the syslog server as well as the HF is the same machine.what i can find in syslog is upto date logs.But HF is not reading the logs from the syslog. I have checked the inputs.conf file.which is all perfect.i am not able to find any issues. ... View more

thanks for your reply. i am getting internal logs as well as few other syslog in SH.But couple of the logs are not ingested into splunk for last few days. ... View more

Thanks for your reply. what makes me confused is couple of weeks back also we detected log drop ,then the tile was in red and showed values like 5k ,6k and all.that means even after 2 days of log drop tile was showing the value since the last log was onboarded and in red. Now the case is just after a day since the last log came into splunk it started showing N/A and in grey.   this strange behavior is making me things hard to understand. ... View more

@richgallowayThank you so much for your reply. Below is the search query  | metadata type=sourcetypes index=websense-dlp_sec | eval diff=(now()-lastTime)/60 | table diff it used to give some information and which will be displayed in the glass table tile.From yesterday its not happening. There is an underlaying issue which we where debugging related to log drop from a tool since 2 days back.as the logs are not coming in it should show in red colour with the minutes since the last log came. Previously  it use to show the correct value with red colour.Can anyone help me to sort this issue. Same is there for another tile too which was in red colour now showing N/A.Dont know whether this related to the above issue or not. search Query for this is  | metadata type=hosts index=fort*| eval diff=(now()-lastTime)/60| search host="FGT-MGMT"| table diff   ... View more