My point was someone asked if fixed in 8.2.4 and it is not. I ran the search as admin and it should not have failed. There are no other errors for this head at that time so I believe this is a bug. ... View more

We are on 8.2.7 and just saw this error so not fixed in 8.2.4 It was a very long running job with a lot, lot of events. ... View more

So you enable or disable batch search mode on the heads in limits.conf. By default it is enabled. https://docs.splunk.com/Documentation/Splunk/9.0.0/Knowledge/Configurebatchmodesearch And you set the number of pipelines on your indexers.  https://docs.splunk.com/Documentation/Splunk/9.0.0/Knowledge/Configurebatchmodesearch#Configure_batch_mode_search_parallelization     ... View more

| rex "\[yyy\] (?<three_words>\S+\s+\S+\s+\S+)" | table three_words This creates a new field called three_words ... View more

I think you would have to carefully craft a string of earliestTime >= and latestTime <= for all the four hour time slots over the past 14 days. ... View more

Is there a timestamp on your lines? Do you have props for this sourcetype? ... View more

Hello. I see that 8.2.6 was released today and the Fixed Issues section says this bug is fixed. I have not confirmed this.   https://docs.splunk.com/Documentation/Splunk/8.2.6/ReleaseNotes/Fixedissues 2022-02-15 SPL-218996, SPL-207039 Single Value Visualization on Dashboard displays smaller font ... View more

I don't know why you get the error for that index. Did you fix the config and restart? If so, did you get the same error? Can you run btool to display your indexes settings? /opt/splunk/bin/splunk btool indexes list --debug   ... View more

Hi. Does your primary volume stanza really have [volume:primary] path = /opt/splunk/var/lib/splunk 500GB maxVolumeDataSizeMB = 500000 That 500GB should be commented out I think. ... View more

Thanks for reporting on this. It is so useful. What version did you upgrade from where the issue was not there? ... View more

I believe they are referring to looking at Javascript errors https://javascript.info/devtools ... View more

Looks like Splunk offered a solution starting in 8.1.7 and 8.2.4 https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues   Searches are cancelled or time out when the user leaves the browser window or switches tabs. Workaround: In Splunk Enterprise 8.1.7, 8.2.4, and higher change the job_default_auto_cancel setting in $SPLUNK_HOME/etc/system/local/web.conf from the default value of 30 to 62. Details This issue is caused by power saving settings in recent browser versions, where Javascript timers may be throttled. The user typically sees the following message in the search window on foreground searches: DAG Execution Exception: Search has been cancelled Search auto-canceled The search job has failed due to an error. You may be able to view the job in the Job Inspector ... View more

Looks like you are looking for the clean command   https://docs.splunk.com/Documentation/Splunk/8.2.4/Indexer/RemovedatafromSplunk ... View more

Hi. Have you looked at the distsearch settings wrt bundles? https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Limittheknowledgebundlesize So in the distsearch.conf there is both replicationWhitelist and replicationBlacklist. These are regex that specify what gets put into the knowledge bundles. To find out exactly what is in place, use btool on your Splunk Search head and examine the setting. I like to add --debug in order that I can see exactly which app is contributing to the setting. By that I mean an app can have a distsearch.conf, you might have settings in etc/system/local/distsearch.conf etc /opt/splunk/bin/splunk btool distsearch list replicationWhitelist --debug /opt/splunk/bin/splunk btool distsearch list replicationBlacklist --debug   For example for me /opt/splunk/bin/splunk btool distsearch list replicationWhitelist --debug [replicationWhitelist] /opt/splunk/etc/apps/splunk_archiver/default/distsearch.conf javabin = apps/splunk_archiver/java-bin/... /opt/splunk/etc/system/default/distsearch.conf kvstore = kvstore_*/... /opt/splunk/etc/system/default/distsearch.conf other = (system|(apps/(?!pdfserver)*)|users(/_reserved)?/*/*)/(bin|lookups)/... (etc) ... View more

For TLS if the certificate expires you will not get data sent.   ... View more

Hi. Thanks for the responses. So as an experiment with my two users.. I never removed the first user. I login locally and that user does not see their knowledge object (extract) BUT it is there on the local disk. So the meta data is gone I guess. We had this happen on a SHC so I repo'd on a standalone head. I can totally reproduce this.   ... View more

The object doesn't show under "All configurations" ... View more

Hi. You need to have three search heads as a minimum in a search head cluster https://docs.splunk.com/Documentation/Splunk/8.2.3/DistSearch/SHCarchitecture I am not sure how you have setup a cluster with only two heads.     ... View more

Hi. Weird. If I am not logged in or AM logged in I don't see the 403 forbidden. Is this happening for all the courses?     ... View more

Hi. Can you try now. It's working for me now. ... View more