It was me It was me It was me.... my problem was that my access permissions on the local directory where my *.conf files was NOT accessable to the splunk user... so it could not read the files... Just goes to show ... Don't assume - Make sure !!! ... View more

Yip, i am trying to figure out what went wrong, if i do not delete the files in the default directory i am back to where i started. I have now setup a new instillation and i am testing it with that now. I agree 100% the default did needs to stay as is. will post my new answer. ... View more

My Solution is the following, there might be some bad suggestions here but it worked for me. mv limits.conf to $SPLUNK_HOME/etc/system/local backup and remove following conf files in $SPLUNK_HOME/etc/system/default outputs.conf pdf_server.conf prefs.conf props.conf viewstates.conf only the following conf files in $SPLUNK_HOME/etc/system/local remove any other. inputs.conf props.conf README server.conf tenants.conf props.conf must look like this (clear file then copy info in) [default] CHARSET = UTF-8 LINE_BREAKER_LOOKBEHIND = 1000 TRUNCATE = 100000 DATETIME_CONFIG = /etc/datetime.xml ANNOTATE_PUNCT = True HEADER_MODE = MAX_DAYS_HENCE=2 MAX_DAYS_AGO=2000 MAX_DIFF_SECS_AGO=3600 MAX_DIFF_SECS_HENCE=604800 MAX_TIMESTAMP_LOOKAHEAD = 128 SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE = BREAK_ONLY_BEFORE_DATE = true MAX_EVENTS = 5000 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = TRANSFORMS = SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard LEARN_SOURCETYPE = false maxDist = 100 [log4j] #pulldown_type = true MAX_EVENTS = 7000 #MAX_TIMESTAMP_LOOKAHEAD=25 SHOULD_LINEMERGE = true TRUNCATE = 1000000 restart splunk Like i said there might be some bad advice in the answer. I am still trying to find out what i did wrong in the first place... but this is working for me for now. thanks kristian.kolb ... View more

Hay i just saw that all the mulit events is 1024 characters long.... and the show source data is fine with no multi events. ... View more

Mmmm i have made the change as requested and BOOM!!! nothing 😞 I am still getting the same result = munti events... if i send the data via netcat to the splunkforwarder i get about 12 events with only limited bogus data in the events on the indexer. If i send it directly to the indexer i get the same results. if i netcat it to the forwarder with no dates i get the 381 events again. ... View more

MAX_EVENTS = 7000 in my conf file am i missing another place where this must go? well i have inserted a date at the start of my data and the end of it. now i get a 381 event and then 227 then a 226 event and last the date in a event. ... View more

I get more than 1 event with each 257 lines till the last event with maybe 129 lines or so. ... View more

Well seems I am the only one with this prob. I found a workaround to the problem. Just install a script on start up before Splunk starts up to clear the host and guid properties.... So every time the Splunk forwarder starts up it will repopulate the host field in the inputs.conf and guid field in the server.conf files. As per Splunk Doc = http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Makeadfpartofasystemimage ... View more

HI lguinn I have set the props.conf but I still get the same result. This makes me believe that my forwarder is not forwarding the data correctly to the indexer I think. (We do not use the file as this will put strain on the host.) Does the forwarder only send data and not change or add anything like dates or timestamps? (How can I see what the forwarder gets and send?) ... View more