All Apps and Add-ons

Why am I getting zero search hits in SplunkIT 3.2 on Splunk 7.2 enterprise trial Version?

swathi_dell
New Member

I am using splunkit 3.2 in Splunk 7.2 environment(trial version). The data generation & index testing went well but I am running into an issue with search test as I am getting zero search hits.
First thing I would like to know is splunkit 3.2 compatible with enterprise splunk 7.2(free 60 days trial version)? If yes, did anybody run into this issue?

Because in the trial version, indexing and searching capability is 500 MB.

Can you please help?

0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

According to the splunkbase page, SplunkIT was community supported by someone called Sunny Choi and has not been updated since 2014. It does not show compatibility past 6.1 but that does not mean it isn't... just that it has not been attended to. (perhaps)

You might want to take a look at this: https://answers.splunk.com/answers/204003/splunkit-32-with-splunk-62-data-generation-index-t.html although the problem is not solved there. So at this point it would mean taking the thing apart to see what might be not working or abandoning ship.

I think it's safe to say that enough time has passed and enough work has been done on the monitoring console that SplunkIT has perhaps lost it's usefulness.

What you might want to do, is compose the concept you are trying to prove out into a new answers question. I'm sure that users in production would be able to provide more real world benchmarking information than a limited trial can.

Your trial is limited in how much it can index per day before Splunk Complains (but you can index as much as you want) and it will eventually call you out on it. There aren't any more restrictions until the trial reverts to the "Free" version which has only one user (admin) and cannot be configured in a distributed environment.

Compose your question in a way that the headline really asks your main question. I bet folks will share their experience. It might be more than one question that you ask in different entries...

Best of luck

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

According to the splunkbase page, SplunkIT was community supported by someone called Sunny Choi and has not been updated since 2014. It does not show compatibility past 6.1 but that does not mean it isn't... just that it has not been attended to. (perhaps)

You might want to take a look at this: https://answers.splunk.com/answers/204003/splunkit-32-with-splunk-62-data-generation-index-t.html although the problem is not solved there. So at this point it would mean taking the thing apart to see what might be not working or abandoning ship.

I think it's safe to say that enough time has passed and enough work has been done on the monitoring console that SplunkIT has perhaps lost it's usefulness.

What you might want to do, is compose the concept you are trying to prove out into a new answers question. I'm sure that users in production would be able to provide more real world benchmarking information than a limited trial can.

Your trial is limited in how much it can index per day before Splunk Complains (but you can index as much as you want) and it will eventually call you out on it. There aren't any more restrictions until the trial reverts to the "Free" version which has only one user (admin) and cannot be configured in a distributed environment.

Compose your question in a way that the headline really asks your main question. I bet folks will share their experience. It might be more than one question that you ask in different entries...

Best of luck

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

swathi_dell
New Member

Hi in that case i tried splunk 6.1 trail version to check the compatibility with splunkIT 3.2 but looks like that license is expired and i can only run on latest splunk versions?this means i will not be able to test on splunk 6.1 anymore?
or anybody tried adding licence to make it run??

Is there any other benchmarking tools for testing splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...