Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Prakash493
Prakash493
Communicator
Member since:
04-07-2018
06-05-2020
Community Statistics
| Posts | 89 |
| Solutions | 4 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 04-07-2018 |
Activity Feed
- Got Karma for Re: Unable to view thawed data. 04-01-2021 02:09 AM
- Posted Splunk DB Connect Connection To SQL on Splunk Search. 02-04-2020 02:27 PM
- Posted Re: Splunk server Patching on Deployment Architecture. 12-10-2019 02:05 PM
- Posted Re: Splunk server Patching on Deployment Architecture. 12-10-2019 12:04 PM
- Posted Splunk server Patching on Deployment Architecture. 12-06-2019 02:13 PM
- Tagged Splunk server Patching on Deployment Architecture. 12-06-2019 02:13 PM
- Posted Re: Min IOPS Requirement for 1 TB indexing /per day on Splunk Dev. 12-06-2019 08:49 AM
- Posted Min IOPS Requirement for 1 TB indexing /per day on Splunk Dev. 12-06-2019 08:40 AM
- Tagged Min IOPS Requirement for 1 TB indexing /per day on Splunk Dev. 12-06-2019 08:40 AM
- Posted Re: Splunk query to see Linux patching on Deployment Architecture. 12-06-2019 08:38 AM
- Posted Re: Splunk query to see Linux patching on Deployment Architecture. 12-06-2019 08:37 AM
- Posted Splunk query to see Linux patching on Deployment Architecture. 12-03-2019 02:06 PM
- Tagged Splunk query to see Linux patching on Deployment Architecture. 12-03-2019 02:06 PM
- Posted Re: How to monitor and alert when the Splunk universal forwarder service has been stopped or modified? on Getting Data In. 11-26-2019 02:08 PM
- Posted Re: How to find LDAP accounts that have been disabled for longer then 30 days on Splunk Enterprise Security. 11-26-2019 11:15 AM
- Posted Re: How to monitor and alert when the Splunk universal forwarder service has been stopped or modified? on Getting Data In. 11-26-2019 11:08 AM
- Posted Re: Unable to view thawed data on Splunk Search. 11-21-2019 01:29 PM
- Posted Re: Unable to view thawed data on Splunk Search. 11-19-2019 07:00 AM
- Posted Re: Unable to view thawed data on Splunk Search. 11-19-2019 06:59 AM
- Posted Re: Unable to view thawed data on Splunk Search. 11-18-2019 02:23 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-14-2019
04:54 PM
Correct i changed as a user and performed as root and everythink works fine
... View more
05-10-2019
08:24 PM
Solved the first issue , just removed the app splunk_httpinput as a admin and rebuilt the app as admin and did a restart and able to enable the global settings And off/on SSL got all the data coming back.
... View more
05-10-2019
04:04 PM
Hi , i am running currently 2 issues. My all Http event collector tokens are disabled and it says enable global settings when i click and enable global settings it says unable to write to /etc/apps/httpinput/disabled:0 please help me ?
Second issue is my Db connect v3.1.4 saying cannot contact to task server port while i try to change the port to 1025,1030 and restarted its failing to restart. Please guide me on it
... View more
05-10-2019
08:15 AM
Splunk HTTP event collector not sending data to an index. I have HTTP event collector configured in HF . And it sends data to indexers. I am not able to get the data on indexers. Please any one face this issue.
... View more
- Tags:
- splunk-enterprise
05-09-2019
09:52 AM
Hi ,
i have a heavy forwarder where my db connect v 3 is installed and i am sending the data to my indexers , the data is forwarding to the indexers and i can see it but the amout of data was forwarded to my index was high but now i see the amount of data is forward to my index is less as compare to before. whats the reason ?
... View more
05-08-2019
02:29 PM
Ok got it my inputs are on heavy forwarders whereas my outputs are on search head now if i move my outputs of db connect from search head to HF i am not getting any data your answer satisifies me to have outputs of db connector on search head so it will read data from indexers , dis i understand correct ?
... View more
05-08-2019
01:57 PM
Hi Currently we have Splunk db connect installed on heavy forwarder and we have inputs configured on heavy forwarder version 3. Where we have outputs setup on search head that used some spl query to run. I want to use outputs setup on heavy forwarder but when i run those splu queries i am not getting any data , is their any way that i can make my heavy forwarder talk to my search heads to get the data or which is recommended to use outputs on heavy forwarder or in search heads ?
... View more
- Tags:
- splunk-enterprise
05-08-2019
07:29 AM
whats this following command SPLUNK_HOME/bin/splunk _internal call /storage/passwords/test , will you please tell in the format like ./ which i need to execute in bin ?
... View more
05-08-2019
07:26 AM
but my indexer cluster master node and monitoring console node is on the same server , still do i need to copy the splunk.secret file ?
... View more
05-08-2019
05:43 AM
Hi , i have a indexer cluster of 3 indexers and 2 search heads are in a cluster and having the pass4symmkey. Which authenticate the connections between slaves and masters. Now my task is to add more indexers in a cluster so i need the pass4symmkey inorder to do that. Currently i wont have the password stored anywhere. How can i change the pass4symmkey value how can i recover the password ?
... View more
- Tags:
- splunk-enterprise
05-05-2019
01:17 PM
Hi I have an issue , i have a gap in splunk logs for a 20 minute , i saw my splunk universal forwarder is up and running , collecting logs but for a 20 min period it didnt ingest any logs then after some time it again ingest logs , how do i find what happend on that 20 minute period also how can i recover those logs which went missing for 20 minutes.
... View more
05-02-2019
05:53 PM
Thank you so much for info
... View more
05-01-2019
06:10 PM
Yes we checked with ldap team they are telling we are not receiving issues with any other teams just from splunk kind of stuck now
... View more
05-01-2019
04:15 PM
our users are not able to login to splunk everyday for 1 hour after that time period it becomes normal , it says cannot contact LDAP server , will you please help what might be the issue ?
... View more
- Tags:
- splunk-enterprise
04-30-2019
03:40 PM
Hi , i am running the script for summary indexing backfill , after running few times its getting failed says time out ? what will be the issue ?
le "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 500, in simpleRequest
raise splunk.SplunkdConnectionException, 'Error connecting to %s: %s' % (path, str(e))
splunk.SplunkdConnectionException: Splunkd daemon is not responding: ("Error connecting to /servicesNS/dgk1/search/saved/searches , The read operation timeout
... View more
04-26-2019
05:28 AM
Yes installed by admin and i am user but before i am able to start and stop not now
... View more
04-26-2019
04:28 AM
Hi , i have an issue our one of indexer goes down because it says unable to start because splunk is unable to read the file from following location. Please check the permissions.
Is it really a permission issue if splunk is unable to read a file from a directory ?
... View more
04-25-2019
10:33 AM
Hi , i am also in the same situation , i create the indexes in master-apps and push it out successfully , my concern is we are using search head cluster with a search head deployer to push the apps , do i need to copy my indexes.conf to each of the search heads too if so only search head or in search head deployer too. in which location of search head i need to copy and paster the indexes.conf
... View more
04-25-2019
09:54 AM
i have seen in my splunk environment all the indexes under at /opt/splunk/etc/master-apps/(app name)/local then indexes are their ,should i create here or this location opt/splunk/etc/master-apps/_cluster/local/indexes.conf. , i am not seeing any indexes here ?
... View more
04-25-2019
07:42 AM
how can i know that this data is archived from which indexer, also whats the location for frozen bucket i am assuming it /var/lib/splunk/(indexer_name)/thaweddb right ? , also after moving the data i need to rebuild it and execute the restart of all indexers ?
... View more
04-24-2019
02:48 PM
Ok thank you ao much for info
... View more
04-24-2019
02:44 PM
Thanks but after that i dont need to do anything search head deployer , or when i search in search head it will come automatically right ?
... View more
04-24-2019
10:49 AM
Hi , i have a clustered environment
3 search heads and a cluster , in cluster i used to deployer apps
have 4 indexers and an indexer cluster master
i need to create an index but confuse where to create should i create it in indexer cluster master and push the bundle to other indexers if i do so is user able to search through search heads , or do i need to deploy it in search head deployer and push the updates ,
i am confused between these two.
... View more
04-24-2019
09:01 AM
Hi soni i have gone through this document i have an indexer cluster so in any indexer i can login and go to that index and copy the files to the thawdb directory ? Or should i do it in indexer cluater master ?
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
