Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ddrillic
ddrillic
Ultra Champion
Member since:
12-26-2014
01-03-2026
Community Statistics
| Posts | 2285 |
| Solutions | 53 |
| Karma Given | 332 |
| Karma Received | 290 |
| Member Since | 12-26-2014 |
Activity Feed
- Karma Re: Tips on how to create props.conf on Splunk cloud for tscroggins. 12-30-2025 01:54 PM
- Karma Re: Tips on how to create props.conf on Splunk cloud for richgalloway. 12-30-2025 01:54 PM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-30-2025 09:17 AM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-29-2025 05:22 PM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-29-2025 07:04 AM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-28-2025 01:57 PM
- Karma Re: Tips on how to create props.conf on Splunk cloud for tscroggins. 12-28-2025 01:57 PM
- Posted Re: Tips on how to create props.conf on Splunk cloud on Getting Data In. 12-24-2025 04:32 PM
- Karma Re: Tips on how to create props.conf on Splunk cloud for bowesmana. 12-24-2025 04:31 PM
- Karma Re: How to upgrade OpenSSL on Splunk servers? for PickleRick. 12-24-2025 04:15 PM
- Karma Re: How to specify an index when deploying the Splunk Universal Forwarder on a Windows domain? for Wander. 12-24-2025 04:13 PM
- Posted Re: how to monitor switch, router, firewall, etc? on Getting Data In. 12-08-2025 10:05 AM
- Posted Re: Data Onboarding CPU consumption 150% system stuck. on Getting Data In. 12-08-2025 09:11 AM
- Posted Re: Forward ingested data on Splunk Cloud Platform. 11-30-2025 03:24 PM
- Posted Re: How to rename dynamic fields ? on Splunk Search. 11-28-2025 02:49 PM
- Karma Re: High Percentage of Small Buckets on Indexer – Mostly on _internal Index for richgalloway. 11-28-2025 02:28 PM
- Karma Re: Does the REST API allow to retrieve the XML source code of Classic Dashboards? for livehybrid. 11-19-2025 02:16 PM
- Karma Re: Does the REST API allow to retrieve the XML source code of Classic Dashboards? for bowesmana. 11-19-2025 02:15 PM
- Got Karma for Re: Who should be the owner of my Saved Search and Reports in Splunk?. 11-19-2025 02:40 AM
- Posted Re: uberAgent on Getting Data In. 11-13-2025 01:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-23-2019
06:06 PM
Gorgeous @jkat54 - so the architect lab material can be improved ; -)
... View more
06-23-2019
05:43 PM
1 Karma
I wonder whether during a Splunk upgrade we can use our two sites of the multisite indexer cluster to improve the Splunk upgrade. Meaning, is it possible to upgrade the indexers of one site and then upgrade the indexers of the second site?
In our upgrade last week we simply upgraded all the indexers together and it took the indexers over 12 hours to catch up with the indexing load, replication and buckets fix-up.
It relates to Large amount of buckets that need to be fixed after the upgrade?
... View more
06-23-2019
05:15 PM
A related question at What’s the relation between the site_replication_factor and replication_factor in a multisite indexer cluster?
... View more
06-23-2019
05:14 PM
1 Karma
I’m told by the architect lab notes that when we have site_replication_factor origin:1,total:2 then the replication_factor is 1.
Is it true?
If it’s true it means that replication_factor has different meanings in a Multisite Indexer Cluster and in a non-Multisite Indexer Cluster.
The way I read is that replication_factor is derived directly from site_replication_factor , which means that in the Multisite conetxt, replication_factor is redundant. Is it right?
It relates to What is origin when setting a Multisite Indexer Cluster?
... View more
- Tags:
- multisite
06-23-2019
04:58 PM
Gorgeous @skalliger.
... View more
06-23-2019
11:28 AM
@dbroggy, it's an interesting thing, we configure using the cluster-config parameter to set the search head as part of the indexer cluster and then we use the shcluster-config parameter to set it up as part of the search head cluster.
So, the node is part of the indexer cluster and also as part of the sub-cluster of the search head cluster.
... View more
06-22-2019
12:15 PM
On the forwarder, for the proper id, what does the ulimit command show - ulimit -n ?
... View more
06-21-2019
02:24 PM
Thank you @twinspop and @jnudell_2 - crcSalt = <SOURCE> seems to be the right one of the two, because each log file is an event here, and each log file has a distinct name.
... View more
06-21-2019
09:25 AM
Gorgeous !
... View more
06-21-2019
08:54 AM
1 Karma
20 it is ; -)
... View more
06-21-2019
08:46 AM
2 Karma
Right @DavidHourani - it will look immediately after the TIME_PREFIX value, so any small integer value will do, right?
... View more
06-21-2019
08:39 AM
1 Karma
I wonder now about the TIME_PREFIX . Is this good?
TIME_PREFIX=Job start date \& time :
... View more
06-21-2019
08:38 AM
Gorgeous @jnudell_2 - much appreciated.
... View more
06-21-2019
08:11 AM
We "normally" would do -
LINE_BREAKER = ([\r\n]+)\*+\s+END\s+OF\s+LOG\s+\*+
Does it make any difference how large the capture group is ?
... View more
06-20-2019
11:55 AM
Makes perfect sense @jnudell_2 - great.
... View more
06-20-2019
11:26 AM
We have log files with the following format:
*******************************************************************************
INTERFACE "<interface name>" - LOG SUMMARY RESULTS
*******************************************************************************
JOB RESULTS:
===============================================================================
Name of the job :<job name>
Name of the xml file :<xml path>
Path of the xml file :<file path>
Database alias :<host name>
Job start date & time :2019-05-08 14:43:28
Job end date & time :2019-05-08 14:43:28
Total job execution time (mins) :0.0
Framework status code :400
Framework status message :Error in parsing the XML Configuration file.
-------------------------------------------------------------------------------
Error details :
-------------------------------------------------------------------------------
Error in parsing the XML Configuration file.
<XML file name>.XML (The system cannot find the file specified)
-------------------------------------------------------------------------------
********************************* END OF LOG **********************************
How do I make each log file a distinct event?
... View more
06-20-2019
10:44 AM
I asked -
-- Once the maintenance mode is lifted, the buckets need to “fix up”.
During this maintenance mode period of around 40 minutes in our case, all the 145 indexers were shut-down, upgraded and restarted. Which buckets at that point, need to be “fix up”?
And the answer by the SE is -
All data that was in a hot bucket when the maintenance mode started and/or any data indexed after maintenance mode started. When you restart you also automatically create new hot buckets, so that has to happen too.
So minimum fixup count =
(Number of indexers)(2 hot bucket rolls)(number of indexes)
That's just the base number. The longer it goes the more buckets, but that's harder to predict.
... View more
06-20-2019
08:44 AM
A related question at Is it possible during an upgrade to postpone the replication by a day or so?
Another related question at - Can we use the two sites of a multisite indexer cluster to improve the Splunk upgrade?
... View more
06-20-2019
08:43 AM
During the upgrade to 7.1.7 we had a couple of challenges and some are mentioned at Large amount of buckets that need to be fixed after the upgrade?
So, let's say, we make the (next) upgrade on Thursday night. Is it possible to "postpone" the replication process, let's say until Friday afternoon?
... View more
- Tags:
- replication
- upgrade
Labels
- Labels:
-
upgrade
06-19-2019
02:32 PM
No doubt - scary thing this replication process is sometimes.
... View more
06-19-2019
01:03 PM
1 Karma
Right @DavidHourani.
There are couple of things here, but what bothers me is -
1) excessive amount of bucket “fixed up”.
2) lack of control over the replication process, especially after such an upgrade.
... View more
06-19-2019
11:40 AM
I would say -
-- Truly, exposing underlying implementation details of the software and asking us to understand them (like TTL) is a funny approach - this is a software deficiency. About the replication, the software should provide more granular replication process, but it's black and white. If replication was more gradual and manageable we should have been fine.
... View more
06-19-2019
11:38 AM
The SE said -
-- When the Splunk indexing cluster is put into maintenance mode (requisite for upgrades) replication of buckets between indexers stops.
Once the maintenance mode is lifted, the buckets need to “fix up”. From a technical perspective this means;
Indexer contacts the Cluster Master and registers the bucket
Cluster master checks the bucket into management and verifies it (MD5 checksum, looks for collisions etc)
Cluster master acknowledges the bucket and begins replication tasks to distribute the data between other indexers.
When you do a large upgrade maintenance mode can last a long time. During that time there’s a backlog of buckets building up to be “fixed up”. Once the maintenance mode is lifted, the entire indexing cluster begins these tasks. However, your indexers will probably be busy with other tasks as well, like indexing new data, replicating new data, fulfilling searches etc. This means that you have resource contention, and that takes time to work through.
The good news is that if the fix-up queue is getting smaller with time, your cluster is working perfectly fine. It’s just busy.
If on the other hand the fix-up queue is stalling or getting larger, you should engage Splunk Support.
... View more
06-19-2019
09:21 AM
That's interesting - I would say around 40 minutes...
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-03-2026
02:09 PM
|
Karma from
Karma given to
