Monitoring Splunk

Community Activity

Backup and restore of Splunk?? Hi, Been trying to backup and restore of Splunk indexer and the steps that I took to backup our splunk server is: - ... by apro Path Finder in Monitoring Splunk 05-21-2010 1 2	1	2
Splunkd crash log - couldn't parse hash code The following line is found when I try to restart the stopped splunkd process:- 05-12-2010 14:30:50.819 ERROR WordP... by aiwatson Engager in Monitoring Splunk 05-12-2010 2 1	2	1
Splunk search 'plan' Is there anyway to run an sql like 'plan' on a splunk search to determine efficiency? by bfaber Communicator in Monitoring Splunk 05-03-2010 5 4	5	4
Why is my search taking so long to run? When I queried a new Summary Index with only 100k of events and 16MB of size, the response time of the a simple query... by Mick Splunk Employee in Monitoring Splunk 04-23-2010 0 3	0	3
Disable monitoring of sub directories Hello How can I monitor the files within a directory but ignore its subdirectories? e.g. I want to monitor all file... by Josh Path Finder in Monitoring Splunk 04-22-2010 2 2	2	2
How can I resolve the error - "The minimum free disk space (2048MB) reached for /opt/splunk/var/run/splunk/dispatch" ? I just upgraded to version 4.1 and I'm seeing this message in the UI. My minimum free disk space is 1GB and I haven'... by Mick Splunk Employee in Monitoring Splunk 04-07-2010 2 1	2	1
How many tags is too many tags? How many tags can be created before Splunk's performance is adversely affected? And what specifcally is adversely af... by Justin_Grant Contributor in Monitoring Splunk 04-05-2010 3 4	3	4
What are some searches I can run to check out the current situation with my queues? I need some help with figuring out some potential blocked queues. What searches can be run to help me figure this ou... by the_wolverine Champion in Monitoring Splunk 04-02-2010 0 2	0	2
How can I control the size and number of Splunk's internal logs? Some of our servers are running low on Disk capacity and we are concerned with splunk log files generated and stored ... by Mick Splunk Employee in Monitoring Splunk 03-30-2010 7 2	7	2
Put Data in Separate Index Based on Timestamp We have Splunk as part of our default vm image but we're having some bucket issues. Initially, the time isn't set an... by oreoshake Communicator in Monitoring Splunk 03-17-2010 2 1	2	1
When should I use a FIFO for an input? I notice there is support for fifo's as inputs. Are there any benefits to using a fifo or is it just support for thos... by Erik_Swan Splunk Employee in Monitoring Splunk 03-13-2010 1 2	1	2
How do I set the default PAGE, instead of just the default app? I've followed the instructions on http://www.splunk.com/base/Documentation/4.0.9/Developer/DefaultApp to set the defa... by oreoshake Communicator in Monitoring Splunk 03-10-2010 6 2	6	2
Timestamp logic/config on forwarder or indexer? I looked at the report for timestamping errors and found a fair amount of errors. I’ve been following the Splunk blo... by oreoshake Communicator in Monitoring Splunk 03-10-2010 0 5	0	5
ERROR SavedSplunker - No record for that user Seeing this error in splunkd.log on a splunk indexer when running a saved search. What does it mean? by Jaci Splunk Employee in Monitoring Splunk 03-01-2010 2 1	2	1
performance characteristics of dedup command I'm thinking about using the DEDUP commend to solve the following problem: I have an event with an ID field and I'd l... by Justin_Grant Contributor in Monitoring Splunk 01-22-2010 2 1	2	1
What sort of hardware should I use for my splunk install? I will have 100GB coming in per day, with an expectation of 20 concurrent users at any given time, with probably arou... by jrodman Splunk Employee in Monitoring Splunk 01-20-2010 2 1	2	1