We are now a days not getting any alerts triggered for our data in environment. when I did go to /opt/splunk/var/log/splunk/scheduler.log even for few back days. going through the alerts I found a coomon reason which reads : savedsearch_name="***************", status=skipped, reason="maxsearches limit reached" I feel some optimization need to be done incase of searches and saved searches running in the env. Do we have any command or plan where we can see which searches are running at that time and causing our alerts to be skipped running daily. Thanks. Vikram. ... View more

Hello Team, I have a server allocated to me with Splunk I installed on it. Now I am unable to integrate the Splunk instances together e.g Indexer, Searchhead and get data into Splunk. When I tried telnet for the Splunk servers on port 8089 and 9997 it is showing me not reachable. Other than this when I reachedout to the infra team they suggested they have opened the port it is just that the service is not running and that is the reason the port isnot getting telnet and reachable. I am seeing on the server that Splunk is running fine and so I am confused now is there any other service Splunk runs on 9997 and 8089 port. Please let me know which services are running on 8089 and 9997 port so that we can get into the root cause get the env up and reporting. Below are the services I can see running on the Splunk instances I am talking about. [splunkqaindexer1 ~]$ ps -ef | grep -i splunk splunk 19521 1 0 Feb14 ? 00:17:35 splunkd -p 8089 restart splunk 19527 19521 0 Feb14 ? 00:00:28 [splunkd pid=19521] splunkd -p 8089 restart [process-runner] splunk 19535 19527 0 Feb14 ? 00:08:10 mongod --dbpath=/splunkdata/kvstore/mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=/splunkdata/kvstore/mongo/splunk.key --setParameter=enableLocalhostAuthBypass=0 --replSet=AB885084-8D23-43CC-B868-8C1905EB56CF --sslAllowInvalidHostnames --sslMode=preferSSL --sslPEMKeyFile=/opt/splunk/etc/auth/server.pem --sslPEMKeyPassword=xxxxxxxx --nounixsocket --noscripting splunk 19642 19527 0 Feb14 ? 00:05:59 /opt/splunk/bin/python -O /opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000 splunk 19699 19527 0 Feb14 ? 00:01:43 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore root 54540 54511 0 07:09 pts/2 00:00:00 su - splunk splunk 54544 54540 0 07:09 pts/2 00:00:00 -bash splunk 54581 54544 0 07:10 pts/2 00:00:00 bash splunk 54626 54581 0 07:10 pts/2 00:00:00 ps -ef These are the processes and services running on Linux server. ... View more

I have created certain searches which shows admin as owner. I want to assign it to another user as the report owner. Can we change owner name of the saved search? ... View more

We are about to integrate Splunk with SAML for authentication, but the SAML team is asking for either the SP certificate file or metadata.xml file. Can some one please help me where can I get the files from, or which command on Splunk Unix server I should fire to get these files? ... View more

We have a request to get values from particular field based on % of bin count. (1) index=ABC | timechart span=1d count by => By this we get count of the bins for the particular days spanned by day (2) index=ABC| top limit=0 => By this we get the bin % of the field value but it is not spanned but for the number of days we select in time picker. So I am looking for a search which will: i. calculate the bin count of the values in i.e error no 400, 200, 201, 208 separately also these should be spanned based on timechart we specify and i.e if I want bin count per day basis for the month it should show that. Thanks for the help in query in advance. ... View more

We have a license of 200Gb which is regularly getting violated. Splunk suggested a non-prod license for our manager for 6 months, so he is suggesting that I change the non-prod license to that dev license by Splunk 50GB daily. My doubt is: (1) on the license manager where 200GB license is deployed can I deploy another instance of non-prod license where Splunk is already specified that non-prod license can not be integrated with any other non-prod or prod license. (2) If non-prod license can be deployed on the same machine please help me understand how can I assign non-prod indexes to that license so that the 200GB license can be totally dedicated to prod servers. ... View more