Hi Splunkers,
Considering delayed syslog data, I have tried the following scripts which output messages to the monitored file by Splunk.
echo -n "Mon Sep 22 17:18:22 2014 +80:00 SESSIONID: "155" ENTRYID: "7" STATEMENT: "7" " >> sample.log
sleep 3
echo "USERID: "GHOST" USERHOST: "Oracle10gR2_linux" TERMINAL: "pts/1" ACTION: "3" RETURNCODE: "0" OBJ$CREATOR: "SYS" OBJ$NAME: "DUAL" OS$USERID: "oracle"" >> sample.log
props.conf is following.
[sample]
LINE_BREAKER = ([\r\n]+)\w{3}\s+\w{3}\s+\d+\s+\d+\:\d+\:\d+\s+\d{4}
TIME_FORMAT = "%a %b %d %H:%M:%S %Y"
Among 0 to 3 seconds as a sleep command argument, Splunk indexed this sample.log properly and it came to be a single event.
However, from 4 seconds, Splunk indexed it as two events.
So I was wondering how to expand this interval?
If you know anything about it, please let me know.
That would be governed by the time_before_close
attribute in inputs.conf. The default value is 3 seconds which means Splunk will wait 3 seconds after reaching EOF for more events to arrive before forwarding/indexing them. Any events which arrive more than 3 seconds after Splunk reaches EOF will be treated as separate events.
That would be governed by the time_before_close
attribute in inputs.conf. The default value is 3 seconds which means Splunk will wait 3 seconds after reaching EOF for more events to arrive before forwarding/indexing them. Any events which arrive more than 3 seconds after Splunk reaches EOF will be treated as separate events.
Thank you, richgalloway.
You're absolutely right.
Thank you very much for your help.
You're welcome. Please accept the answer.