There are descriptions on managing orphaned knowledge objects after deletion of users, for reasons such as change of operator in the following manuals.
http://docs.splunk.com/Documentation/Splunk...
...hat the indexers will share a knowledge bundle, which is copied from one of the search heads, whereas the search heads will continue blissfully oblivious. What's confusing to me is that without mounted b...
We are setting up our first dedicated search head. Need some info of the Knowledge bundle replication process. 1) whatis the maxbundlesize units ? the default 2048 - is...
This issue comes up when you need to delete an obsolete or duplicate tag, event type, transaction, or similar knowledge object. It also turns up in situations where you find you need to change the a...
...mplementing the above mentioned change and then restart Splunkd? Some bundles are almost a year old. What will be the impact of this, or is there anything I should take care of before doing this or is t...
...o know the best efficient way to migrate knowledge objects. Our estimate of the size could be between 2 GB to 5 GB. Our approach is iterative and not big-bang , so would like to provide less d...
Hello,
In MS Access there is a Relationships Manager "tool" to keep track of how the tables, forms, searches, etc. relate to each other in a database app. Is the same available in Splunk? If not, what...
...ounted one search head's $SPLUNK_HOME/etc/system directory to the same shared storage location that the pool is using."
but there are no instructions that i can find that explain exactly what that means....
...arameters in the Python scripts to change to download the full knowledge base, I've tried changing detail = Basic to All and the new full knowledgebase is downloaded into the tmp file, however, it's n...
...ncremental process rather than one big 'switch over'. My questions are: > Which knowledge objects can be accessed via federation? > What are examples of federated syntax for 'inputlookup', 'l...