Does anyone know of best practices around managing SummaryIndexes in a consistent way?
Let’s say that some data occasionally arrives late (eg. forwarder was down). The scheduled search t...
I'd like to see if there's a "right" way to solve this problem. I've got a lot of delayed entry for data that gets summaryindexed on an hourly basis. Most data gets into the system between 30 and 9...
...'m not sure what the response back means exactly.
'eligible' is a scheduled search and I'm trying to run that same search but using it to backfill the summaryindex.
How can one make a cron schedule in Splunk run just in specific year? This can be easily done in 8-digit type of cron schedules but splunk uses just 5 digits.
The case is that I need to backfill summary...
I'm seeing the error below under messages in my Splunk enterprise console:
Missing or malformed messages.conf stanza for TCPOUT:FORWARDING_BLOCKED_Indexer IP ADDress_default-autolb-group DC-Host N...
I have a search I created that runs for the last 5 minutes. I scheduled this to run every 5 minutes to update a summaryindex I have. I am finding duplicates on my data. Is there a better way to manage...
...iscarded from the results by Splunk. For example, for a one-hour time range like 9:00:00 to 10:00:00, the index is only populated with the events from 9:00:00 to 9:59:30. This issue caused some gaps...
...as skipped for ingestion and the next day therefore indexes two days of event data at once, the report for the summaryindex will crash and there will be a gap in the summaryindex. To avoid data gaps...
Will summaryindex searches be queued up for a certain amount of time or will the searches simply be skipped and a backfill script will need to be run to fill in any gaps?