About robertlynch2020

robertlynch2020 · ‎08-28-2019

Hi Yes tried to reinstall, but same issue.

robertlynch2020 · ‎08-21-2019

Hi Thanks for you comments i will look into a new box Rob

robertlynch2020 · ‎08-21-2019

Thanks - we solved it with a reboot - but next time i will check

robertlynch2020 · ‎08-21-2019

Hi How can i see what Splunk is doing when the CPU goes to ~90% for 30 minutes on my Splunk box and stays there. I have one search head and one indexer all on the same box. How can i tell what is going on, is it too much data coming in or too many data models etc...? Or do i just need to restart etc.. The splunk screens are going very slow - we have about 36 jobs running in parallel. Thanks in advance for any help Rob 🙂

robertlynch2020 · ‎08-15-2019

I tried to update it with the same version but cant remove yet as live environment

robertlynch2020 · ‎08-15-2019

Hi This app was working for a while and it now part of Arfica is not displaying, any ideas? I have tried to resize it but no luck. Cheers Robert

robertlynch2020 · ‎07-17-2019

HI Thanks, but i need it to be dynamic (as host will change) and i think that is a static solution. Rob

robertlynch2020 · ‎07-17-2019

Hi Can i change the name in the Splunk Tabs to use a token like "Host" not "Splunk 7.2.6"(This information is no good to me). Cheers in Advance Rob

robertlynch2020 · ‎06-12-2019

ok thanks

robertlynch2020 · ‎06-12-2019

I have created the app.

robertlynch2020 · ‎06-12-2019

Thanks for the replay. So, i dont need to do anything - this is under the hood for me?

robertlynch2020 · ‎06-12-2019

great thanks, i will try and get back to you

robertlynch2020 · ‎06-12-2019

The apps had a lots of datamodels, so i am trying to understand how it works. If i don't install the apps on to the indexers and the forwarders send the data just to the indexers (not the search head), how does it know what is the structure of the datamodels for acceleration

robertlynch2020 · ‎06-12-2019

Thanks for the answer. So, if i add a new Indexer (Non clustered, search peer). I don't have to install the data models onto that search peer?

robertlynch2020 · ‎06-12-2019

Hi Thanks for this, i will try it and get back

robertlynch2020 · ‎06-12-2019

Hi Do i need to install an APP onto search peers? If so, What is the best approach to get an APP(That i update daily) on to search peers(Indexers, Non Clustered). So i am setting up one Search head and 2 Indexers, I think i have to install the APP onto the search peers, if so how can i manage this, as i will update them daily on my Search Head? Regards Robert

robertlynch2020 · ‎06-10-2019

Hi I have a single install (Everything on one machine). I want to go to one search head and 2 indexers (non clustered) multiple machines. Is there a set of instruction on how to do this, the doc is great but there seem to be so many options that I get lost. I am looking for step 1 2, 3..etc... I also have a question like: If I change the current install from SH+Indexer -> indexer and create a separate search head(I think this is the best way), do I have to reinstall all my apps onto the new search head? Regards Robert

robertlynch2020 · ‎06-10-2019

Hi I have one search head and two indexers (Non-Clustered). So how do I update data models? (E.G new Field, update a field, etc...) Do I do it on the search head and then have to update the indexer configuration manually or does it happen automatically? OR is there something else I am missing? Thanks Robert

robertlynch2020 · ‎06-07-2019

Hi Thanks for the answer. To answer some questions. From which version did you upgrade to 7.2.6? - [RL]we came from 7.1.6. How many GB per day are you ingesting? Why do you want to move to 5 indexers right away? Do you have any experience in building indexer clusters? [RL]We are ingesting 40Gb per day on a busy day, but today when i have the issue we have done 3GB. We are thinking of increasing our indexers anyway due to other issues and i wanted to know it it would help here? I dont mind how many i go to but i just want to know if that will help this issue, I have some experience in setting it up. Some of our data does not have a time stamps, i am not sure if i can do anything about that as i needed it. I know the specific source type its GC data with no timestamp. Thanks in advance for any advice Rob

robertlynch2020 · ‎06-07-2019

Hi, we have upgraded to 7.2.6 and we are getting errors all the time now. Today we have used 3 GB of our licenses- so not much, however, I have issues below (Images). I have 3 questions: 1) We have a single install (1 search head and 1 indexer) and thinking of moving to 5 indexers and 1 search head, will this help this issue? 2) What happens when the tail reader is full, who suffers what are the impacts, how can I help this? 3) What happens when buckets are full, who suffers what are the impacts, how can I help this? Thanks in advance Rob

robertlynch2020 · ‎05-23-2019

Error parsing XML on line 417: Premature end of data in tag form line 1

robertlynch2020 · ‎05-12-2019

Hi From one Splunk Ninja(2017) to another(2018) - thanks very much 🙂

robertlynch2020 · ‎05-10-2019

Hi I am on version 7.1.6 and want to move to 7.2.6 but i have noticed that spark-lines don't work in the new version. Or am i missing something? This is the SPL index=mlc_live | table host _time| chart sparkline count by host | fields - count When i change from fast mode to verbose mode in SPL it works, but you cant save a search that way. Any help would be great.

robertlynch2020 · ‎05-02-2019

HI I want to create a 100% read only user, how do i remove the setting. I hvae tried to remove the "list setting". But i still see the setting, unless it is call something else.

robertlynch2020 · ‎05-01-2019

Sure - sorry and thanks very much

Posts	656
Solutions	34
Karma Given	100
Karma Received	66
Member Since	‎11-05-2015

Online Status	Offline
Date Last Visited	‎02-11-2026 08:22 AM

How to Graph white space before and after my data ...

Can i create trellis with overlays, when the overl...

Can i have overlap on a Multi-series graph

Search for a path the might not exist

Joining Large JSON data fields into one Table

Splitting one row into multiple rows.

mvexpand is heavy is there another way

Can Archived Apps be installed onto Splunk Cloud

Extract some key-value pairs

Splunk Custom Visualizations apps end of life FAQ

Re: Part of Africa is not displaying

Re: High CPU on my Splunk BOX

Re: High CPU on my Splunk BOX

High CPU on my Splunk BOX

Re: Part of Africa is not displaying

Part of Africa is not displaying

Re: Can i change the name in the Splunk Tabs to us...

Can i change the name in the Splunk Tabs to use a ...

Re: Do i need to install an APP onto search peers?

Re: Do i need to install an APP onto search peers?

Re: Do i need to install an APP onto search peers?

Re: How to update datamodels on a distributed syst...

Re: Do i need to install an APP onto search peers?

Re: How to update datamodels on a distributed syst...

Re: Migration instructions from single install to ...

Do i need to install an APP onto search peers?

Migration instructions from single install to dist...

How to update datamodels on a distributed system

Re: How to solve TailReader and buckets errors

How to solve TailReader and buckets errors

Re: Is it possible to Monitor Splunk User activity...

Re: Sparkline not working in 7.2.6

Sparkline not working in 7.2.6

Read only user - remove setting

Re: Why does the Sparkline looks flat sometimes?

Join the Conversation