Hi experts, After submitting a search query via REST API, is there a way to check number of events the search results for the job id? Without which, I won't know if  how many GET each limited to 50K results which is something I run into as well. Alternatively, is there an argument that I can use in HTTP GET to splunk to override the 50K limit? Thanks, MCW ... View more

You can check the "messages" key in the job status results (what you get back when you query the http://localhost:8089/services/search/jobs/*search_id* REST endpoint for the job. This contains sets of messages grouped by priority, and within each of those, any messages generated by the search. You could also check the "searchProviders" key in the job status results and compare against a list of the desired indexers. "messages" appears not to be in the current documentation, but it does come back. ... View more

I'm not 100% sure what all you've tried. I would start with simply setting up an appropriate props.conf entry, for example: [the_source_type] TIME_FORMAT = %H:%M:%S,%3N %m/%d TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 40 # Assuming your files are on a single line, so you should set this too: SHOULD_LINEMERGE = False Do you regularly load these files from the previous year? Or are you concerned about when the year rolls over? If you have splunk actively monitoring your files (either locally, via splunk forwarder, or over a network share) and aren't doing any kind of batching process (or log file shipping), then you should be fine as splunk read the files pretty quickly. Having said that, I haven't really tested this configuration too closely, as splunk seem to just get it right. That, and the year change doesn't happen all that often... ... View more

please check this answer about the misleading option followtail. http://splunk-base.splunk.com/answers/57819/when-is-it-appropriate-to-set-followtail-to-true ... View more