Hi, We have a Hadoop cluster where in we are storing data. We have downloaded Splunk enterprise and the Splunk App for Hadoop Ops to look into our Hadoop cluster operations. We are not going to be indexing any data into the Splunk instance. This being the case, do we have to pay for the license? As per my knowledge, license is only required when data needs to be indexed into Splunk. Thanks, Keerthana ... View more

Hi, We have a Splunk deployment where we expose a splunk app through REST. We connect to the app and run approximately 50 searches every 5 minutes. However, after a while we observe that the searches stop running. Upon debugging we found the following: In the webservice.log file, we got the following error: 2016-11-06 06:28:32,809 ERROR [581ecd72c57f75d01abbd0] init:479 - Socket error communicating with splunkd (error=('ssl.c:587: The handshake operation timed out',)), path = https://localhost:8089/services/auth/login 2016-11-06 06:29:02,853 ERROR [581ecd90d17f75d014d690] __init_:479 - Socket error communicating with splunkd (error=('_ssl.c:587: The handshake operation timed out',)), path = https://localhost:8089/services/auth/login In the python.log file, we got: Splunkd daemon is not responding: ("Error connecting to https://localhost:8089/services/auth/login: ('_ssl.c:587: The handshake operation timed out',)",) In splunkd.log file, we got the following error: 11-13-2016 23:18:58.662 +0000 ERROR HttpListener - Exception while processing request from 1.1.1.1 for /en-US/custom/XXX/YYY/URLparameters: Connection closed by peer 11-13-2016 23:18:58.662 +0000 ERROR HttpListener - Handler for /en-US/custom/XXX/YYY/URLparameters sent a 0 byte response after earlier claiming a Content-Length of 26! We ran the command netstat -neap | grep 8089 and got the following output: tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN 0 136045514 tcp 0 0 127.0.0.1:8089 127.0.0.1:52914 SYN_RECV 0 0 tcp 0 0 127.0.0.1:8089 127.0.0.1:52908 SYN_RECV 0 0 tcp 1 0 127.0.0.1:8089 127.0.0.1:45149 CLOSE_WAIT 0 139900826 14993/splunkd tcp 1 0 127.0.0.1:8089 127.0.0.1:45984 CLOSE_WAIT 0 140090123 14993/splunkd tcp 1 0 127.0.0.1:8089 127.0.0.1:42823 CLOSE_WAIT 0 140067803 14993/splunkd tcp 1 0 127.0.0.1:8089 127.0.0.1:33117 CLOSE_WAIT 0 140194381 14993/splunkd tcp 1 0 127.0.0.1:8089 127.0.0.1:48657 CLOSE_WAIT 0 139922911 14993/splunkd tcp 1 0 127.0.0.1:8089 127.0.0.1:60258 CLOSE_WAIT 0 140186060 14993/splunkd The ulimit value for the system is set as 4096 and we found event in splunkd.log saying: 11-14-2016 04:13:25.605 +0000 INFO loader - Limiting REST HTTP server to 1365 sockets 11-14-2016 04:13:25.605 +0000 INFO loader - Limiting REST HTTP server to 1365 threads How do we fix this issue? When does the CLOSE_WAIT status appear for any connection? Any help is greatly appreciated. Thanks, Keerthana ... View more

Hi, We have a Splunk application with two indexers and we have summary indexing running on both of them. I would like to know how exactly Splunk does the summarization. Will the data from both indexers be combined and then aggregated? Or, will the data be computed individually in each of the indexes? If the second case is true, how accurate will the data be, considering that metrics like average will vary based on the sum and count of data present in each of the individual indexer? ... View more

Hi, I have a csv file with nearly 50000 rows. When I try to fetch all the rows using the inputlookup command, I am not able to retrieve all the 50000 rows. Only 42000 odd rows are returned. Also, when I use this csv for lookup, for all the rows that are present after the 5000th row, lookup is not happening. However, if I take a particular row and place it within the 5000 rows, lookup happens succesfully. Can anyone explain this strange behavior? Please let me know what changes I should make in conf files to enable succesful lookup. I checked the max_memtable_bytes value in my setup and my csv file size is way below the limit. Thanks, Keerthana ... View more

Hi, We are using Splunk native apps to display geo based information. When we hover over the points plotted, the latitude and longitude information gets displayed. Is there any way we can avoid it? I want only the metric to be displayed. My search query is as below: my search | geostats sum(Count) as Total Here I want only the Total value to be displayed and the latitude and longitude values to be removed. Please help me out. Thanks, Keerthana ... View more

We have a CSV table from where we perform lookups. The CSV file has nearly 50000 rows. When I run the lookup query, results are not returned for some of the rows. I picked one value for which lookup was not happening, made its entry the first row (earlier it was the 5286th row) in the CSV and reduced the number of rows in the CSV to 3. The lookup was then successful. Is there any limit to the number of rows that will be looked up when we run lookup command? I checked the max_memtable_bytes value in my limits.conf and the CSV table size is way below the limit. We use Splunk version 5.0.4 Thanks, Keerthana ... View more