Hi Splunkers, I have the forwarder installed on nix machine. It was working perfectly until today when I made some changes in Inputs.conf to add more log files. When I restarted the forwarder again, it came up and Splunk is restarted successfully but no logs were forwarding. However, I did face some warning. "Set the Ulimit, Splunk may not work" Is Ulimit the issue? If it is, then suddenly why did it stopped working? Thanks for the help. ... View more

Hi Splunkers, One of my Universal forwarder was down for a month. So when i noticed I restarted the services back again but it is not coming up. I am facing the below error. Can someone please help Splunk> Needle. Haystack. Found. Checking prerequisites... Checking mgmt port [8089]: open Assertion failed: _linkp == nullptr, file /home/build/build-src/orangeswirl/src/util/TimeoutHeap.cpp, line 46 Dying on signal #6 (si_code=0), sent by PID 0 (UID 0). Attempting to clean up pidfile ERROR: pid 8454562 terminated with signal 6 SSL certificate generation failed. Can someone please assist ... View more

Hi Splunkers..I need Splunk components Data flow diagram and how are they communicating each other. Can someone please share brief diagram ... View more

Hello Splunkers, In my organization Patching activity has been scheduled and under that all my splunk components will be down i.e Search head,Indexers,Master server etc. I need to bring all the Splunk components down and then restart them after 9 hours of maintenance. Can anyone tell me any standard procedure to do this activity. Like which component should be down and bring up first. I will really appreciate help on this. Regards, Devang ... View more

Hello Splunkers, I need to extract only the date with the below logs in format mm/dd/yyyy. Could you please assist? Thanks Tue Apr 02 00:00:00 EDT 2019 ... View more

Hi Splunkers, I want list of all the forwarders with their first installation date or exactly since when they are sending data to Indexers. Can someone please provide any details on this. Appreciate your help on this. Thanks ! ... View more

Hello Splunkers, I need to upgrade my current Splunk multi cluster environment from 6.0.1 to 7.2.3. Present Infrastructure where Splunk 6.0.1 is present:- Two indexers Two search heads(SHP) One Cluster master Futuristic Infrastructure where Splunk 7.2.3 will be deployed. I have ordered completely new devices. Once upgrade is done, we will decommission old infrastructure Two indexers Two search heads One Cluster master One Deployment server My biggest challenge is I want to transfer all the data from old(6.0.1) system to new(7.2.3) system. How can this be achieved ? What is the Step by Step process to follow ? Any help will be highly appreciated. ... View more

Hello Splunkers, My Infrastructure team is going to patch all the servers where Splunk is currently installed. Are there any steps which i need to take to perform this activity. ... View more

Hi Splunkers, One of my indexers is not able to communicate with the master properly. Previously, it was working fine. Due to this, index replication is not working properly. Error on Indexer Gui In handler 'clusterslaveinfo': Slave is unable to handle request at this time. This means either slave is unable to communicate w/ master OR master does not have peers added to the cluster. Check master dashboard and/or master_uri/secret settings. Config File Failed to register with cluster master reason: failed method=POST path=/services/cluster/master/peers master=https: rv=0 actual_response_code=500 expected_response_code=201 status_line=HTTP/1.1 500 Internal Server Error [ event=addPeer status=retrying AddPeerRequest: { _id= active_bundle_id=B735 add_type=Initial-Add base_generation_id=0 forwarderdata_rcv_port=9100 forwarderdata_use_ssl=0 mgmt_port=9089 name=7 register_forwarder_address= register_replication_address= register_search_address= replication_port=9200 replication_use_ssl=0 replications= server_name= } ]. 02-13-2019 14:17:36.768 +0100 INFO LicenseMgr - Initing LicenseMgr 02-13-2019 14:17:36.768 +0100 INFO LicenseMgr - Initing LicenseMgr runContext_splunkd=true 02-13-2019 14:17:36.768 +0100 INFO LicenseMgr - StackMgr init complete... 02-13-2019 14:17:36.834 +0100 WARN LMDirective - directive cmd=D_set_feature_state args='AWSMarketplace,DISABLED_DUE_TO_LICENSE' failed: reason='feature='AWSMarketplace' is invalid' 02-13-2019 14:17:36.834 +0100 INFO LMTracker - Setting feature=AllowDuplicateKeys state=DISABLED_DUE_TO_LICENSE (featureStatus=2) 02-13-2019 14:17:36.834 +0100 WARN LMDirective - directive cmd=D_set_feature_state args='HideQuotaWarnings,DISABLED_DUE_TO_LICENSE' failed: reason='feature='HideQuotaWarnings' is invalid' 02-13-2019 14:17:36.834 +0100 INFO LMTracker - Setting feature=ResetWarnings state=DISABLED_DUE_TO_LICENSE (featureStatus=2) 02-13-2019 14:17:36.835 +0100 WARN LMDirective - directive cmd=D_set_feature_state args='SubgroupId,DISABLED_DUE_TO_LICENSE' failed: reason='feature='SubgroupId' is invalid' 02-13-2019 14:17:36.836 +0100 INFO LicenseMgr - Tracker init complete... 02-13-2019 14:17:38.768 +0100 INFO WatchedFile - Will begin reading at offset=16950 for file='/APPLICATIONS/splunk/var/log/splunk/license_usage.log'. ... View more

Hello Splunkers, I want to put restrictions on the seach time period , right now one user can search for as long as they like..Now i want retrictions on it, lets say 30 min...eg he can search for longer time periods say for 3 months data but his search time shouldn't exceed beyond 30 min. Where should i make this change ... View more