There are descriptions on managing orphaned knowledge objects after deletion of users, for reasons such as change of operator in the following manuals.
http://docs.splunk.com/Documentation/Splunk...
...hat the indexers will share a knowledge bundle, which is copied from one of the search heads, whereas the search heads will continue blissfully oblivious. What's confusing to me is that without mounted b...
currently half of my searchheads are shutdown (auto shutdown due to issues within Splunk) and the remaining are not able to query the indexers
The problem is caused by a large knowledge bundle....
We are setting up our first dedicated search head. Need some info of the Knowledge bundle replication process. 1) whatis the maxbundlesize units ? the default 2048 - is...
...mplementing the above mentioned change and then restart Splunkd? Some bundles are almost a year old. What will be the impact of this, or is there anything I should take care of before doing this or is t...
This issue comes up when you need to delete an obsolete or duplicate tag, event type, transaction, or similar knowledge object. It also turns up in situations where you find you need to change the a...
...o know the best efficient way to migrate knowledge objects. Our estimate of the size could be between 2 GB to 5 GB. Our approach is iterative and not big-bang , so would like to provide less d...
I have knowledge objects in my custom apps which are created & managed in /default by manually uploading to splunkcloud and installing. this causes me a couple of problems : 1. even though t...
...ave found, actions we have taken, etc. I am curious how others are doing this, and if there is a good way to do this within Splunk itself? Essentially, this would be using Splunk as a knowledge base....
...reate any global App? is there any specific App or place to do this? 3. most of these are .csv files, Bin and Jar files. I could see few splunk community answers, but I couldn't see any c...