We are on 8.2.7 and just saw this error so not fixed in 8.2.4 It was a very long running job with a lot, lot of events. ... View more

So you enable or disable batch search mode on the heads in limits.conf. By default it is enabled. https://docs.splunk.com/Documentation/Splunk/9.0.0/Knowledge/Configurebatchmodesearch And you set the number of pipelines on your indexers.  https://docs.splunk.com/Documentation/Splunk/9.0.0/Knowledge/Configurebatchmodesearch#Configure_batch_mode_search_parallelization     ... View more

| rex "\[yyy\] (?<three_words>\S+\s+\S+\s+\S+)" | table three_words This creates a new field called three_words ... View more

I think you would have to carefully craft a string of earliestTime >= and latestTime <= for all the four hour time slots over the past 14 days. ... View more

Is there a timestamp on your lines? Do you have props for this sourcetype? ... View more

Hello. I see that 8.2.6 was released today and the Fixed Issues section says this bug is fixed. I have not confirmed this.   https://docs.splunk.com/Documentation/Splunk/8.2.6/ReleaseNotes/Fixedissues 2022-02-15 SPL-218996, SPL-207039 Single Value Visualization on Dashboard displays smaller font ... View more

I don't know why you get the error for that index. Did you fix the config and restart? If so, did you get the same error? Can you run btool to display your indexes settings? /opt/splunk/bin/splunk btool indexes list --debug   ... View more

Hi. Does your primary volume stanza really have [volume:primary] path = /opt/splunk/var/lib/splunk 500GB maxVolumeDataSizeMB = 500000 That 500GB should be commented out I think. ... View more

Thanks for reporting on this. It is so useful. What version did you upgrade from where the issue was not there? ... View more

I believe they are referring to looking at Javascript errors https://javascript.info/devtools ... View more

Looks like Splunk offered a solution starting in 8.1.7 and 8.2.4 https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues   Searches are cancelled or time out when the user leaves the browser window or switches tabs. Workaround: In Splunk Enterprise 8.1.7, 8.2.4, and higher change the job_default_auto_cancel setting in $SPLUNK_HOME/etc/system/local/web.conf from the default value of 30 to 62. Details This issue is caused by power saving settings in recent browser versions, where Javascript timers may be throttled. The user typically sees the following message in the search window on foreground searches: DAG Execution Exception: Search has been cancelled Search auto-canceled The search job has failed due to an error. You may be able to view the job in the Job Inspector ... View more

Looks like you are looking for the clean command   https://docs.splunk.com/Documentation/Splunk/8.2.4/Indexer/RemovedatafromSplunk ... View more

Hi. Have you looked at the distsearch settings wrt bundles? https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/Limittheknowledgebundlesize So in the distsearch.conf there is both replicationWhitelist and replicationBlacklist. These are regex that specify what gets put into the knowledge bundles. To find out exactly what is in place, use btool on your Splunk Search head and examine the setting. I like to add --debug in order that I can see exactly which app is contributing to the setting. By that I mean an app can have a distsearch.conf, you might have settings in etc/system/local/distsearch.conf etc /opt/splunk/bin/splunk btool distsearch list replicationWhitelist --debug /opt/splunk/bin/splunk btool distsearch list replicationBlacklist --debug   For example for me /opt/splunk/bin/splunk btool distsearch list replicationWhitelist --debug [replicationWhitelist] /opt/splunk/etc/apps/splunk_archiver/default/distsearch.conf javabin = apps/splunk_archiver/java-bin/... /opt/splunk/etc/system/default/distsearch.conf kvstore = kvstore_*/... /opt/splunk/etc/system/default/distsearch.conf other = (system|(apps/(?!pdfserver)*)|users(/_reserved)?/*/*)/(bin|lookups)/... (etc) ... View more

For TLS if the certificate expires you will not get data sent.   ... View more

Hi. Thanks for the responses. So as an experiment with my two users.. I never removed the first user. I login locally and that user does not see their knowledge object (extract) BUT it is there on the local disk. So the meta data is gone I guess. We had this happen on a SHC so I repo'd on a standalone head. I can totally reproduce this.   ... View more

The object doesn't show under "All configurations" ... View more

Hi. You need to have three search heads as a minimum in a search head cluster https://docs.splunk.com/Documentation/Splunk/8.2.3/DistSearch/SHCarchitecture I am not sure how you have setup a cluster with only two heads.     ... View more

You probably want to find out why the UF it's crashing. It is generally very robust. Are there errors that you can share? You can probably increase the logging level to help find what might be going wrong.   ... View more

Hi. I am not understanding the difference between the two searches. Can you share the exact settings in the saved search for the time? In case you have a personalized time setting to show you events in some specific time zone ( eg your events are in UTC but you want to see the time in terms of EST) you should know that the scheduled job times are with respect to this time zone setting of the user is the scheduled job.   ... View more

Splunk says to upgrade from version 7 you said e go to version 8 or 8.1 and then to 8.2   https://docs.splunk.com/Documentation/Splunk/8.2.2/Installation/AboutupgradingREADTHISFIRST     ... View more

Hi. As an experiment I used a deliberately bad token and found this error.  Try searching for errors.   index=_internal host=myindexers* log_level=ERROR component=HttpInputDataHandler 10-01-2021 23:00:15.133 +0000 ERROR HttpInputDataHandler - Failed processing http input, token name=n/a, channel=n/a, source_IP=1.2.3.4, reply=4, events_processed=0, http_input_body_size=39, parsing_err=""     ... View more