Getting Data In

What do we do if our UDP events are being delayed?

sdubey_splunk
Splunk Employee
Splunk Employee

We are experiencing a delayed indexing of UDP events.

Environment: UF -> Indexer.

Event1 was sent to indexer(confirmed via tcpdump that the messages are sent successfully to indexer).

Event2 was sent after 4 hours and only then was Event1 visible via search and Event2 searchable. Then, after that, Event3 is sent. So in short there is delay in indexing.

Already tried: props.conf

[devservers]
TRANSFORMS-index = hosts
SHOULD_LINEMERGE = false
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^

2.Also tried updating props.conf (Event had date twice in the event)
BREAK_ONLY_BEFORE_DATE

How do we fix this issue?

Tags (2)
0 Karma
1 Solution

sdubey_splunk
Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

View solution in original post

0 Karma

sdubey_splunk
Splunk Employee
Splunk Employee

The issue has been resolved after implementing the DATETIME_CONFIG=none in props.conf and restarting splunk service.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...