In Splunk 4.1.x, both 'attempt' patterns are intended to work. There may be some outstanding issues with followTail, so you may want to evaluate what results you get without that. You may want to try turning on some debug settings to get more insight, or work with Splunk Support. In etc/log-local.cfg, you could turn these on. category.TailingProcessor=DEBUG category.WatchedFile=DEBUG category.BatchReader=DEBUG You can also turn them on/off interactively from Manager. This might be of use: http://www.splunk.com/wiki/Community:Troubleshooting_Monitor_Inputs#File_inputs ... View more

This is normal. If you're choosing to turn your Windows auditing to record every process launch and termination, then on many server applications you should expect to see many such events. This corresponds to only about one process launch and exit every 7 seconds or so. ... View more