It was all was working fine but suddenly I see some pages are not opening. I restarted splunkd and splunkweb but that didn't help. All splunk processes are up and running fine on the server: $ ./splunk status splunkd is running (PID: 119967). splunk helpers are running (PIDs: 119968 120009 120173 120284 120338). Kinda weird, but could someone please help me figure out the issue? Thanks Ishaan ... View more

I have a SHC of 4 SHs with a h/w LB upfront. There needs to be a health_check_api.html file in the server so that the LB can use that to check whether the SH is up or not. My question is, what is the path in the server when we hit the URL http(s)://SearchHead>:8000 so that I could keep my api file health_check_api.html file in that location? Thanks, Ishaan ... View more

Hi, I have a Search Head Cluster of 4 Search Heads and have configured a few saved searches. My SPLUNK version is 6.3. I use the loadjob command to get the latest result of my saved searches. Activity -> Jobs shows me the saved search in "Done" Status (screen shot: pic 1) However, when I click on the link which takes me to the Search App, it throws me an error (screen shot: pic 2) Is it a bug in 6.3 or am I going wrong somewhere? Thank you! Ishaan ... View more

I have SPLUNK 6.3 version and have 4 indexers in the cluster. I installed SPLUNK DB Connect v2 app on the standalone dev SH. I added a DB connection in the app, which was successfully tested (showed schema names in the preview). Then, I gave read permission to "All Apps" for the SPLUNK DB Connect 2 app (using Manage Apps), the Identity (in DBconnect 2 app), and the DB Connection (in DBconnect 2 app). However, when I run an adhoc search query in the Search app, I get 4 errors, one for my 4 indexers each indexer. I am wondering, why the Search app is looking in my indexers? After all, it is an adhoc db query. P.S. The Splunk DB Connect 2 app is only installed in my standalone dev SH, not on the Indexers. Please help! Thanks Ishaan ... View more

Hi, I want the background fill (newly introduced in 6.3 Single Value) of a Single Value panel be based on value of a column called "range". And, its label be based on value of another column called "Share_Name". Is it possible in 6.3? ... <Initial Search> ... |head 1|eval range=case(share_value>=90,"severe", availability>=80,"elevated",1=1,"low")|eval Share_Name="myShare"|table Header range Right now, it shows myShare as the foreground text but the background is coming as black color. I want the background color fill be based on the range column value, but the foreground text as "myShare" in above case. Thanks for your help! Ishaan ... View more

I understand we can run adhoc sql queries without indexing in DB Connect 1 in the Search app: |dbquery DB_Connection_Name "<sql query>" Is it possible to do the same in DB Connect 2? If yes, could you please let me know how? Thanks Ishaan ... View more

I wish to uninstall an app from my Search Head cluster and cluster peers. Is this the following the way to go about it? On each Search Head and peer cluster member: 1.Run the following command in CLI ./splunk remove app [appname] -auth <username>:<password> 2.Remove user-specific directories created for your app or add-on by deleting the files found here: $SPLUNK_HOME/splunk/etc/users/*/<appname> And, If the instance is a search peer, also delete the relevant index 4.Restart Splunk Then, Delete directory from $SPLUNK_HOME/etc/master-apps in Master Node Delete directory from $SPLUNK_HOME/etc/shcluster/apps in Deployer ===== Or, is there a central way to do this from the Deployer/Master? ... View more

Dear SPLUNK Community, I have one development Search Head and a Search Head Cluster in my cluster. I am using the default search app to create dashboards on a dev SH. I create dashboards with the admin role and share it with all users within the App. I also use custom css, js, and images in the dashboards. Could you please help me understand the best way to migrate the dashboards I develop in dev SH to SHC? (I do have a Deployer as well) I read somewhere that since Search is a default app, I should not be pushing it to a SHC using the Deployer as it may override the app version. Thank you so much! Ishaan ... View more

Dear SPLUNK Community, According to the documentation: http://docs.splunk.com/Documentation/UnixAddOn/5.2.0/User/DeploytheSplunkAdd-onforUnixandLinuxinadistributedSplunkenvironment we need to install the Supporting Add-on (SA-nix) on the Search Head and Indexer clusters. I have already installed the Splunk Add-on for Unix and Linux on the Search Head and Indexer clusters. And I do forward all data from SHs to indexer cluster. I would like to know what would happen if I do not install the SA-nix there? Thank you! Ishaan ... View more