Hi,
We have a scenario where the Splunk is not indexing the last event received via syslog. The search results are always n-1 where if I have to get the last event, I need to generate one more event. Mostly cisco syslog and linux syslog are affected by this. In the data summary, it shows that there is a latest event, but when the search is run, it doesn't show the latest event, but shows the previous one as the latest. The syslogs are coming through universal forwarder. Have tried sending them directly to the indexer and still the same issue. Has anyone come across such issues? Please let us know.
↧