...upport ssh key authentication for the Splunk Phantom warmstandby script (i.e. do not prompt for the password of the OS username that is running Phantom).
I've configured a pair of Phantom servers to use warmstandby. As per the documentation, I ran ibackup.pyc --setup after setting up warmstandby, then ibackup.pyc --backup and it works fine.
I...
Hello, I am wondering when my index will roll from warm to cold with the settings below, the rest of the settings is default: [XXXX] frozenTimePeriodInSecs = 46656000 maxDataSize = a...
Hello I had that red warning right before the username in splunk and after analyzing I found that there were a few sourcetypes with wrong timeparsing. I have fixed all of these fails but the red wa...
we set the buckets to roll from hot into cold for 90 days, but for some reason is not doing it and we are running low on space. How can I manually move buckets from to cold to free space Tha...
...here are not issues with the logs indexed by foo index.
Then I checked with this search:
index=_internal sourcetype=splunkd component=HotBucketRoller "finished moving hot to warm" | eval b...
...ssuming that the replication is happening properly,
When my hot bucket rolls to warm, What happens to the rest of the buckets that are replicated on the indexers?
When my warm bucket rolls to c...
Failure to open phantom (4.10.x) GUI after setting up warm/standby , no error message when setup warm/standby and starting phantom. Any further troubleshooting or logs to check ?