Hello, I currently have an intake that is exceeding 100GB per day and I would like to know what are the best practice recommendations to support this intake without affecting performance. How many servers or indexers are needed and their minimum and recommended specifications?

  i have setup on prem new SH cluster and Deployment server with Splunk enterprise version 8.2.5. I have configure new 3 SH as slave and pointed to License Master but Salve not syncing with License Master. Note: We have three license pool in License master and I have update pool stanza in server.conf as well but no luck. Please suggest.   I have performed below config steps on server.conf on 3 SH and Deployment Host Separately.  Select a new passcode to fill in for pass4SymmKey. SSH to the Splunk instance. Edit the /opt/splunk/etc/system/local/server.conf file. Under the [general] stanza pass4SymmKey field, replace the hashed value with the new passcode in plain text. It will stay in plain text until Splunk services are restarted. Save the changes to the server.conf file. Restart Splunk services on that node.     Here is the server.conf on SH as License Slave. ----------------------------------------------------------------------------------------------------------------------------------------------- [general] serverName = SHHost123 pass4SymmKey = Same is License Master   [license] master_uri = https://x.x.x.x:8089 active_group = Enterprise   [sslConfig] sslPassword = 12344…   [lmpool:auto_generated_pool_download-trial] description = auto_generated_pool_download-trial quota = MAX slaves = * stack_id = download-trial   [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder quota = MAX slaves = * stack_id = forwarder   [lmpool:auto_generated_pool_free] description = auto_generated_pool_free quota = MAX slaves = * stack_id = free   [lmpool:auto_generated_pool_enterprise] description = auto_generated_pool_enterprise1 quota = MAX slaves = * stack_id = enterprise   [replication_port://9023]   [shclustering] conf_deploy_fetch_url = http://x.x.x.x:8089 disabled = 0 mgmt_uri = https://x.x.x.x:8089 pass4SymmKey = 23467…. shcluster_label = shclusterHost_1 id = D6E63C0A-234S-4F45-A995-FDDE1H71B622

I find myself using Splunk Cloud and I see that the licensing is being exceeded on daily. In the Cloud Monitoring Console APP there is no option that allows me to see what the sourcetype is and this would help me to know exactly which source has increased usage.

Hello, We are still facing the following issue when we put in maintenance mode our Indexer Cluster and we stop one Indexer. Basically all the Indexers stop ingesting data, increasing their queues, waiting for splunk-optimize to finish the job. This usually happens when we stop the Indexer after a long time since last time. Here below an example of the error message that appears on all the Indexers at once, on different bucket directory:     throttled: The index processor has paused data flow. Too many tsidx files in idx=myindex bucket="/xxxxxxx/xxxx/xxxxxxxxxx/splunk/db/myindex/db/hot_v1_648" , waiting for the splunk-optimize indexing helper to catch up merging them. Ensure reasonable disk space is available, and that I/O write throughput is not compromised.     Checking further, going into the bucket directory, I was able to see hunderds of .tsidx files. What splunk-optimize does is to merge those .tsidx files.   We are running Splunk Enterprise 9.0.2 and: - on each Indexer the disk reach 150K IOPS - we already performed this set-up that improved the effect, but hasn't solved it:     indexes.conf [default] maxRunningProcessGroups = 12 processTrackerServiceInterval = 0     Note: we kept maxConcurrentOptimizes=6 as default, because we have to keep maxConcurrentOptimizes <= maxRunningProcessGroups (this has been also confirmed by Splunk support, that informed me maxConcurrentOptimizes is no longer used (or used with less effect) since 7.x and it is there mainly for compatibility) - I know since 9.0.x there is the possibility to manually run splunk-optimize over the affected buckets, but this seems to me more a workaround than a solution. Considering a deployment can have multiple Indexers it is not straightforward   What do you suggest to solve this issue?   Thanks a lot, Edoardo

I have a query where I'm looking for users who are performing large file transfers (>50MB).  This query runs every day and as a result we have hosts that are legit.  These hosts names are extracted from the dst_host field of the results from my search.  As we compile a list of valid hosts, we can simply add that to the query to be excluded from the search like:  index=* sourcetype=websense* AND (http_method="POST" OR http_method="PUT" OR http_method="CONNECT") AND bytes_out>50000000 NOT (dst_host IN (google.com, webex.com, *.zoom.us) OR dst_ip=1.2.3.4) I know there's a better way to add the excluded host or IPs in a file that I can query against to exclude but I'm not sure how to do that.  I don't want to update the query everyday with hosts that should be excluded but rather a living document that can be updated with hosts or IPs that should excluded. Can someone send point me in the right direction for this issue.

Hi ,  I want to rename to Required Parameters Longitude and Latitude are missing or invalid to a new value Required Parameters missing.   index="****" k8s.namespace.name="*****" "Error" OR "Exception" | rex field=_raw "(?<error_msg>Required Parameters Longitude and Latitude are missing or invalid)" | stats count by error_msg | sort count desc   Any help will be great

Hi, I've been told, that using field extractions on json is not best practis and that I should use calculated fields instead. In some cases thats easy and I can use replace or other methods to do that but in some it is more difficult.  I have some events giving me information about software versions. When I try to extract the version string from as follows, I get the results for events containing this string. In all other cases I get the complete string instead. What I need is the matching string or nothing. I couldn't figure out how to do that. replace(message, "^My Software Version (\S+).*", "\1")