Now I am planning to rotate the logs being monitored by Splunk. I will also use the compress option to rotate. But one thing to worry about... If log rotation is done and files are compressed before splunk has finished loading the logs, will the logs be missing on Splunk? Is there also a recommended setting of rotate etc? ... View more

In my environment the following servers exist. windows 2012 R2 Splunk 6.5.2 On this server, when trying to export logs in csv format on Splunk web, the line breaking twice and outputted with blank line between each line. I suspected a misconfiguration of a specific log, but even if I exported _internal log, a line breaking was done. After converting it to binary format and confirming it, I found that the first line feed was done in CR format and the second line feed seemed to be done in CRLF format. I think that it caused by reconverting only the LF part of the line feed in CRLF format into CRLF again. I predicted that the following phenomena might be occurring. _raw ~ CRLF (* At this time still a single line break) _raw ~ CR CRLF (* LF is converted to CRLF, and the number of line feeds is twice.) Is this a known issue? ... View more

I want to know about CPU occupation when doing a real-time search. If I build Splunk in a standalone way, and I configure a real-time search, I think that one of cpu core will be occupied. But which server's cpu core is occupied by real-time search when configuring distributed search like indexer clustering? will only cpu core of the search head be occupied? Or, because it is a distributed search, will cpu core of each search peer also be occupied? Also, if I configured search head clustering, will cpu core of all members be occupied? I am planning to create large scale configuration for personal use, and planning configure alerts using real time search (rolling window) in the environment, so I want to know how to use cpu core. I appreciate if someone tell me about it. ... View more

I want to visualize network between each servers. But I could not find a visualization app like I'm looking for. The visualization of the topology of aws' app is fairly ideal, Is there no app that can use such a topology visualization generically? I do not mind even the method using js or css. If someone know about it please tell me. ... View more

I want to know whether existing a problem between Splunk server of 6.3 series and Splunk server of 6.5 series(especially about search and indexer clustering). And if there is a page like that list of information, I want to see. Does anyone know such a page, or issues between Splunk server of 6.3 series and Splunk server of 6.5 series? ... View more

In my environment, I have two indexers for one Search head. I think that these commands like "search", "dedup", "transaction" are processed by indexer in distributed search. But are these commands in the sub search such as "map", "join" etc processed by indexer too? Could anyone tell me? ... View more

In my environment, I have two indexers for one Search head and I created a data model in Search head for accelerating searching. Now, I want to know how is the data model created on two indexers. Do each have exactly the same data model? Or each have one data model in a dispersed form? I am sorry for the rudimentary question, but could anyone tell me about it? ... View more

In the following search I divide data with multiple multi-value fields into one line at a time. See this answer ↓ https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html | eval reading=mvzip(multi_value_field1, multi_value_field2) | eval reading=mvzip(reading, multi_value_field3) | eval reading=mvzip(reading, multi_value_field4) | mvexpand reading | makemv reading delim="," | eval field1=mvindex(reading, 0) | eval field2=mvindex(reading, 1) | eval field3=mvindex(reading, 2) | eval field4=mvindex(reading, 3) | ... The result is OK with this search, but somehow the warning "Field 'reading' does not exist in the data." Is displayed. Is there a way to avoid this warning? my splunk ver : 6.5.3 ... View more