Hi, I have one index(test0) in a standalone server. I'm trying to make 3-month data searchable after 6 months of data to Archive And after 12 months of data to delete/retention Below is my con...
Hi, this error message started popping up, on Splunk Cloud. As you already know in Splunk Cloud you do not have access by SSH to the internal files of Splunk, bin, etc. Why is it and how ca...
Hi, I have an issue in indexer cluster. It's been a month since i noticed there are different number of buckets in two indexers. Search factor, Replication factor fine. What is the reason for t...
Please confirm something or correct me. If I understand correctly, it's the event's _time that's the basis for bucket ageing (hot->warm->cold(->frozen)), right? I understand that it's t...
Does anyone know of a way to reverse the order of the automatic start/end values used for bucket creation when working with timechart (or other similar commands)? For example, if I have a timechart w...
Hello,
I'm new here and I wanted some help for this issue.
My incident is getting many errors for a bucket replication that keeps flapping up/down. In the master dashboard I have the errors "s...
Hi,
As soon as data moves from cold to frozen bucket it gets deleted? How data moves from frozen bucket to Thawed bucket. The data in thawed bucket is that searchable? How long data will be in t...
Hello, Recently I been getting Bucket error in index processor everyday. I am rebooting the Splunkd service everyday to get rid of this error. How to identify the root cause of this issue and fix i...
There isn't a way to set RF for different buckets, right? e.g. hot RF 2, cold no RF We're using smartstore, therefor S3 is handling cold bucket replication and it would drastically reduce the s...
Are Smartstore buckets uploaded to S3 immutable? We've been using Smartstore for almost a year and I have never seen an update to a bucket after its original upload to S3. Can anyone c...