If I have a problem and I am stressed out and on the verge of a nervous break down because my Global Splunk framework just came crashing down.....what 3 things would you want me to tell you
**(that don't include did I open a P1, know how and upload a diag, and write a novel about the problem).
What am I looking for, what do you need to know, how can I best describe my problem that can best help you help me?
@ehollima for posting a question on Splunk Answers and to get best available help refer to Splunk Answers User Manual for How to ask a question. Provide as much detail as possible. However, at the same time depending on the sensitivity of information you should mask/anonymize any information that should not be posted in an open forum.
However, I am afraid for the situation that your first/best option is to work with Splunk Support Team/your Splunk Technical contact.
Try first to troubleshoot the problem.
Here are some tips:
A. Using btool command
Check for typographical errors
$SPLUNK_HOME/bin/splunk cmd btool check
e.g. /opt/splunk/bin splunk cmd btool check
Check the specific type of config file and search using a keyword
$SPLUNK_HOME/splunk cmd btool list --debug | grep
e.g /opt/splunk/bin/splunk cmd btool indexes list --debug | grep _introspection
B. Check the Splunk Community Portals
Ask Splunk experts:
Splunk for developers:
Hot wiki topics:
Splunk user groups:
C. Check the Splunk logs to get some clues what's going on and what errors are happening.
e.g. tail /opt/splunk/var/log/splunk/splunkd.log
cat /opt/splunk/var/log/splunk/splunkd.log | grep ERROR