Hello, I configured my index in the /etc/system/local/indexes.conf as follows: [weblogsindex] homePath = $SPLUNK_DB\weblogsindex\db coldPath = $SPLUNK_DB\weblogsindex\colddb thawedPath = $SPLUNK_DB\weblogsindex\thaweddb frozenTimePeriodInSecs = 47304000 However I don't see any buckets being deleted from the folder, and the disk usage is still increasing. How can i check what the youngest event in a bucket is, or is there a better way to see if the archiving is working, that would be much appriciated. ... View more

Hello, I want to monitor a directory but within that directory is another directory which I want to index under a different Source Type. specifcally: [monitor:///var/log/*] sourcetype syslog and the subfolder monitor:///var/log/apache2/* sourcetype apache_error But the second input falls under the first, and since data isn't indexed twice, I'm wondering how splunk is going to handle this. Will it just index the apache logs with the first rule with sourcetype syslog. Or is splunk smart enough to index the apache logs with the sourcetype apache_error if i define the second input like that. Or do I put the apache data input before the other one? Or do I blacklist the folder in the first input rule, if so, how? ... View more