- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Splunkd errors.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello All,
I am seeing long set of splunkd errors. Most of them are repeated. I wanted to know if affects the splunk performance? Do i need to worry about the splunk internal errors, which doesn't really affect my operations?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It really depends on the errors that you are getting.
For example if you are getting a lot of Exec processor errors it could be that Splunk can't run a script because of permission issues. That probably won't affect performance that much.
However, if you see a lot of Regexor processor errors it probably means that you have a lot of slow or inefficient regexes. Or maybe you've got events with more than 256 lines and based on your configuration, you are truncating events without times stamps and that will slow splunk down. If you up the event size in this case, it would help those errors.
If you see Aggregator process, Date processor verbose then those are all related to props.conf and you could be having issues with line breaking, line merging or time zone issues which could certainly affect performance.
There are a lot of variables and it might be worth a call into support or if you think it's the right time to clean up your environment you can bring in our Professional Services team to do some work and show you what to look for in the future while the fix the existing issues.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It really depends on the errors that you are getting.
For example if you are getting a lot of Exec processor errors it could be that Splunk can't run a script because of permission issues. That probably won't affect performance that much.
However, if you see a lot of Regexor processor errors it probably means that you have a lot of slow or inefficient regexes. Or maybe you've got events with more than 256 lines and based on your configuration, you are truncating events without times stamps and that will slow splunk down. If you up the event size in this case, it would help those errors.
If you see Aggregator process, Date processor verbose then those are all related to props.conf and you could be having issues with line breaking, line merging or time zone issues which could certainly affect performance.
There are a lot of variables and it might be worth a call into support or if you think it's the right time to clean up your environment you can bring in our Professional Services team to do some work and show you what to look for in the future while the fix the existing issues.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Noted, will keep these points in my mind. Thank You.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Currently we don't feel much impact, but Errors like javabridge error,Bundle archiver warning. Everything seems to be fine but in SOS app the error level is pretty high. I am concerned about future when it's in full scale.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
More specific error messages would help determine if they are affecting your instance.
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
