Monitoring Splunk

Community Activity

Create Splunk Storage (Disk Space) Capacity Alarm (Alert) The OS I am currently using is Redhat, i need help with the query that sends an alert if the DiskSpace goes over 70 ... by shakeel253 Explorer in Monitoring Splunk 10-18-2017 1 3	1	3
Why are the queues being filled up on one indexer? In the last day or two all the queues of one indexer got filled up. We bounced it and now on another indexer all the ... by ddrillic Ultra Champion in Monitoring Splunk 10-18-2017 1 10	1	10
How can I calculate per host CPU utilization in a report? host=test01 index="perfmon" collection="CPU" counter="% Processor Time" \| bucket _time span=15m \| stats avg(Value) as... by JyotiP Path Finder in Monitoring Splunk 10-18-2017 0 1	0	1
How do I Save Raw Log Data for Audit Purposes? If I have a regulatory requirement to store raw data for audit purposes as well as allowing the possibility of other ... by yellek Engager in Monitoring Splunk 10-13-2017 2 7	2	7
May I know how Splunk calculate license usage for Packet collections Hi All I want to know how Splunk will calculate license usages for packets collection? Currently what we are doing i... by nelson_ye New Member in Monitoring Splunk 10-13-2017 0 2	0	2
Can I limit the disk size of a Splunk instance to 300 GB within config files? I'm looking to set up a stand-alone test Splunk instance and want to limit the disk size of the instance to 300GB. ... by natalienguyen Explorer in Monitoring Splunk 10-11-2017 0 3	0	3
How to I add an indexer to the MC? We added recently indexers and all of them show up as being members of the indexer cluster. How do I add them to the ... by ddrillic Ultra Champion in Monitoring Splunk 10-11-2017 0 8	0	8
Why do we get kernel:BUG: soft lockup on the Search Head? We get the following - $ ./splunk status Message from syslogd@<host> at Oct 11 06:02:24 ... kernel:BUG: soft locku... by ddrillic Ultra Champion in Monitoring Splunk 10-11-2017 0 3	0	3
can we use semicolon instead of comma in MVZIP is it possible to use semicolon instead of comma in MVZIP?? by smolcj Builder in Monitoring Splunk 10-06-2017 0 2	0	2
Why did Crash log occur? [build 249101] 2017-08-12 20:00:03 Received fatal signal 11 (Segmentation fault). Cause: Unknown signal origin (s... by khyoung7410 Communicator in Monitoring Splunk 10-03-2017 0 2	0	2
How to turn off splunkd during certain hours I have a customer who wants to have the splunk forwarder turned off during certain critical processing time. by rholm01 Explorer in Monitoring Splunk 10-03-2017 0 4	0	4
how do I generate a diag (Splunk diagnostics file)? How do I generate a diag (Splunk diagnostic) file for splunk support? by benstraw Splunk Employee in Monitoring Splunk 10-02-2017 3 6	3	6
Why is the CPU usage showing 80-100% (falsely)? -- Search help I am trying to get CPU usage for a specific process in windows. My search looks like this: host=host1 AND sourcetype... by lbalaur Explorer in Monitoring Splunk 10-01-2017 0 6	0	6
"HttpListener - Socket error from 127.0.0.1 ... Broken pipe" splunkd.log messages since upgrading to Splunk 6.1.5 The full message is: WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/-/search/admin/sum... by wrangler2x Motivator in Monitoring Splunk 09-29-2017 1 2	1	2
How to resolve error "The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch"? I have this problem: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch. So I ca... by Federica_92 Communicator in Monitoring Splunk 09-29-2017 0 7	0	7
New Errors that did not exist last week Say I did a bunch of changes over the weekend and wanted to see a list of any new errors. Is there a way I can show... by subtrakt Contributor in Monitoring Splunk 09-25-2017 1 5	1	5
Where can I find the internal logs in the Splunk 5.0.1 file directory? Hi, I'm trying to find the var/log/splunk/ folder logs to check the errors and warning but in the older versions spl... by skuma30 New Member in Monitoring Splunk 09-18-2017 0 3	0	3
Query to setup alert if the diskspace goes over 70%? Below are the Host and Source type, I am trying to setup an alert if the diskspace goes over 70%. can some help? hos... by shakeel253 Explorer in Monitoring Splunk 09-12-2017 0 18	0	18
Measuring Splunkd Uptime Looking for a way to measure splunkd service uptime, and alert on when it's down. Not so much worried about system up... by rgilliam01 New Member in Monitoring Splunk 09-11-2017 0 2	0	2
How to limit datamodel_summary folder disk space Hello guys, i noticed that the datamodel_summary folder is filling up my diskspace... How can i limit this ? It is ... by mbarbaro Path Finder in Monitoring Splunk 08-29-2017 0 2	0	2
Changing timechart x-axis from _time to another field I am looking to chart my data based on another time field than the default _time that splunk uses. is this possible?... by esmonder Path Finder in Monitoring Splunk 08-28-2017 0 1	0	1
What is the expected response time for an HEC POST? We're seeing about 50 ms. Normal range? How would we optimize this? EDIT: Also, how do you measure HEC performance f... by twinspop Influencer in Monitoring Splunk 08-23-2017 1 3	1	3
Using btool command Using btool command i want to check all the conf file or get a list of all conf files where my xyz host entry is pres... by kannu Communicator in Monitoring Splunk 08-21-2017 0 6	0	6
Are there any Splunk apps we can use to audit Oracle behavior like failed logons? I would like to know if there are any Splunk apps which we can use use to audit Oracle behavior e.g failed logons. Sp... by katalinali Path Finder in Monitoring Splunk 08-20-2017 0 2	0	2
Pass privileges from deactive user to active user In splunk cloud I am using splunk cloud for my project, I want to pass on the privileges of a user (who 's I'd is not active anymore)... by Tania19 New Member in Monitoring Splunk 08-19-2017 0 1	0	1