Knowledge Management

how to run splunk diag , and what to exclude from the diag

Koushik_Katta
Explorer

Hi team ,

I want to run a diag , have seen documentation from
http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Generateadiag

kindly explain me what to exclude from the diag as it is consuming more space
how to upload the diag from that ,

Thanks

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

In the same page of documentation, you can find examples of the items that you can exclude from the diag file (link below). Depending on for what issue you're uploading diag for Splunk Support team, you can execlute lookup and dispatch direcotry as they are generally big.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Generateadiag#Examples

Upload instructions are also available in the same page
http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Generateadiag#Upload_a_diag_.28or_...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

In the same page of documentation, you can find examples of the items that you can exclude from the diag file (link below). Depending on for what issue you're uploading diag for Splunk Support team, you can execlute lookup and dispatch direcotry as they are generally big.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Generateadiag#Examples

Upload instructions are also available in the same page
http://docs.splunk.com/Documentation/Splunk/6.5.2/Troubleshooting/Generateadiag#Upload_a_diag_.28or_...

muebel
SplunkTrust
SplunkTrust

Hi Koushik_Katta, You can run the diag by executing this from the command line $SPLUNK_HOME\bin\splunk diag

If you wish to leave out certain components, you can add a --disable= flag such as:

$SPLUNK_HOME/bin/splunk diag --disable=dispatch --disable=pool

This documentation you linked to has more options.

Please let me know if this answers your question!

Koushik_Katta
Explorer

Hi Muebel , It worked i have disabled some .csv , .dat passwords even

Thanks for the help Muebel.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...