Hi Splunkers,
Considering about delayed syslog data, I have tried following scripts which output messages to the monitored file by splunk.
echo -n "Mon Sep 22 17:18:22 2014 +80:00 SESSIONID: "155" ENTRYID: "7" STATEMENT: "7" " >> sample.log
sleep 3
echo "USERID: "GHOST" USERHOST: "Oracle10gR2_linux" TERMINAL: "pts/1" ACTION: "3" RETURNCODE: "0" OBJ$CREATOR: "SYS" OBJ$NAME: "DUAL" OS$USERID: "oracle"" >> sample.log
props.conf is following.
[sample]
LINE_BREAKER = ([\r\n]+)\w{3}\s+\w{3}\s+\d+\s+\d+\:\d+\:\d+\s+\d{4}
TIME_FORMAT = "%a %b %d %H:%M:%S %Y"
Among 0 to 3 seconds as a sleep command argument, Splunk indexed this sample.log properly and it came to be a single event.
However, from 4 seconds, Splunk indexed it as two event data.
So I was wondering at how to expand this interval.
If you know anything about it, please let me know.
↧