Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About vr2312
vr2312
Builder
Member since:
03-10-2015
04-20-2026
Community Statistics
| Posts | 141 |
| Solutions | 15 |
| Karma Given | 46 |
| Karma Received | 15 |
| Member Since | 03-10-2015 |
Activity Feed
- Posted Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite ind on Deployment Architecture. 04-20-2026 02:51 AM
- Posted Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite ind on Deployment Architecture. 04-19-2026 06:04 AM
- Karma Re: Splunk Admin Password for wrangler2x. 12-30-2025 03:38 PM
- Got Karma for Re: How can I completely delete a user in Splunk ES?. 09-07-2024 04:15 AM
- Got Karma for Re: How can I completely delete a user in Splunk ES?. 09-07-2024 02:40 AM
- Posted Re: How do I index data from a Cisco IPS? on All Apps and Add-ons. 09-01-2024 08:57 PM
- Posted Re: How can I completely delete a user in Splunk ES? on Splunk Search. 09-01-2024 06:38 PM
- Posted Re: Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 09-01-2024 06:13 PM
- Posted Re: Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 09-01-2024 06:12 PM
- Posted Re: Cant see export csv on my dashboard stiudio(splunk 9.2.1) on Installation. 08-22-2024 12:32 AM
- Posted Re: Cant see export csv on my dashboard stiudio(splunk 9.2.1) on Installation. 08-22-2024 12:00 AM
- Posted Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 08-21-2024 11:58 PM
- Tagged Disabled/Deleted users are appearing in Investigators Panel in Enterpriser Security on Splunk Enterprise. 08-21-2024 11:58 PM
- Posted Re: Configure and Use Enterprise Security Configuration Explorer on Installation. 06-10-2024 07:31 PM
- Posted Re: How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 06-03-2024 09:25 PM
- Karma Re: How to get Splunk sendemail command to send multiple emails based on search results? for sirajnp. 06-03-2024 09:03 PM
- Posted How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 09-21-2023 10:34 PM
- Tagged How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 09-21-2023 10:34 PM
- Tagged How to observe EPS for particular datasource from a Splunk UBA CLI? on Splunk User Behavior Analytics. 09-21-2023 10:34 PM
- Posted Re: What defines an asset priority? on Splunk Enterprise Security. 09-04-2023 07:19 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
08-16-2018
04:48 PM
@gkumarashanmugam
Are you by any chance using the trial version ?
Also as @richgalloway had suggested, try restarting the splunk instance after modifying the authorize.conf.
... View more
08-16-2018
04:44 PM
Hello @rchittip
From your error message, i can observe that the messages.conf has a missing stanza for LM_LICENSE:WARNINGS_GENERATED.
You might want to take a copy of the current setup and compare it with the one available under default.
This post must be able to guide you :
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Messagesconf
... View more
08-15-2018
05:23 PM
There is a possibility that a default splunk app/add-on is using the KV Store resources that is spiking up the CPU usage. You might want to check on it manually and disable the operation to help it from crashing or high utilization.
... View more
08-15-2018
05:21 PM
This is mostly because the indexes.conf are stored in the indexers and are not created locally at the Search Head.
You might want to create a local indexes.conf file on the Search head locally for you to able to see it via the web interface.
But do make sure the values and configuration matches with the indexes.conf present in the indexers.
... View more
08-15-2018
05:19 PM
@kisero
You might want to check on the following :
Capabilities for you to export 1000+ entries
If events populated are in the format to be exported to csv
... View more
08-15-2018
05:17 PM
You can run your search on the basis of indexed time and only use the events that are latest. That is, if you run the search every 4 hours, you can write a query to search for events in indexed time-stamps in those four hours and sort it. That should give you a headstart.
... View more
05-16-2018
05:08 AM
1 Karma
Yes, we have around 28 IDXs with 2.5 TB Data getting in everyday @garethatiag
... View more
04-20-2018
02:34 AM
Hello @cjsweeney1
It seems the account Splunk is being run in the Windows Server does not have the admin privileges to remove the snapshot,old file from the location.
Once the privileges are updated, Splunk would have permission to edit the file and rename it to what is required.
We had this addressed by ensuring the permissions splunk is using in the host are updated.
... View more
04-09-2018
08:53 AM
@splunk24
Please ensure that your CM is well spec. 120 Indexers are huge and they need to be consistenly managed by CM. Ensure the CM is heavily specced and is sustaining connections to/from IDXs.
... View more
04-09-2018
08:52 AM
2 Karma
Okay, from my experiences with dealing with this, this basically triggers when the communication between the CM and the IDXs drop off or are not in a sustainable way.
What actually happens is the CM thinks the IDX (Batch Adding one) cannot perform indexing operations hence it starts to move the IDX off the CM.
We all know that when an IDX drops off the CM, its primary buckets gets distributed to the other IDXs on site. By the time this process initiates/completes, the IDX gets back in a healthy communication position with the CM and hence the Batch Adding triggers.
What i did after this scenario was :
Raised the Specs of the CM as we were under spec
Increased the below specs in server.conf
[clustering] [Cluster Master]
service_interval = 10
heartbeat_timeout = 1800
cxn_timeout = 300
send_timeout = 300
rcv_timeout = 300
max_peer_build_load = 5
(using cluster-bundle deployment, no restart is required)
----server.conf-------- [Indexer]
On the Indexers:
cxn_timeout = 600
send_timeout = 600
rcv_timeout = 600
heartbeat_period = 10
Doing this reduced the instance from this occurring and this has stopped completely.
... View more
02-08-2018
05:05 AM
@harsmarvania57 and @FrankVI
yes, it is not recommended by Splunk, but we have been running like that for the past 5 years and never came across a hiccup. These servers are highly powerful and we found them under-utilizing the resources
... View more
02-08-2018
05:03 AM
@harsmarvania57
Yes. You got me right.
I do understand that, we have 16 HFs in our environment and most of them use this built, hence my question. We were using a 3rd Party LB to manage LB activities, we are trying to get rid of that for Splunk application.
... View more
02-08-2018
04:47 AM
Thank you @harsmarvania57 and @FrankVI for your answers.
If i have one of my Server hosting 4 instances of HF, would i still be able to achieve this ?
... View more
02-08-2018
03:52 AM
We have the current infrastructure :
UF -> HF -> Indexers
Can i set up Load Balancing at the outputs.conf so that data is forwarded equally to the HF ?
I would like to know the pros and cons for this.
... View more
02-07-2018
07:17 AM
We came across an issue this past weekend where the UF on a Windows Server was utilizing high memory usage and when we dug deep, we identified the cause to be Splunk.
While expanding our investigation we can observe the host impacted have a good amount of data waiting.
is this possible that the memory usage was high because of this ?
... View more
01-19-2018
03:20 AM
@sahils
You can monitor if the Backups have failed or succeeded by monitoring the Windows Event Viewer Log for the same.
The below configuration might help you, or you can use the Splunk Windows TA available :
[WinEventLog:Microsoft-Windows-Backup/Operational]
disabled = 0
index = wineventlog
renderXml=false
start_from = oldest
checkpointInterval = 5
... View more
01-02-2018
05:06 AM
@rphillips [Splunk], If i modify anything under the /local directory of the App and i upgrade the app, i believe the changes will still remain. Am i right ?
... View more
12-06-2017
05:46 AM
Thanks for the input @ybongart
Sorted the answer by myself.
The issue was occurring due to a Search head which was brought up which happened to be a clone. hence the server.conf/inputs.conf had the disabled searches search head server name.
... View more
11-23-2017
06:40 AM
I installed an App from Splunkbase for Testing purposes.
The app came with Custom Searches which i had scheduled as per the testing phase.
I had uninstalled the app, however, i can still see searches run from the app though the app no longer exists.
it is not creating much of a trouble but i am wondering from where the searches are being run and how i can stop it.
... View more
08-11-2017
11:10 PM
@kteng2024 I would suggest the approach of creating a new app and just add the attribute to it and send it to two different destinations :
web01abc23
App1
[monitor://xyz.log]
sourcetype=web_log
index=abc
web01cde21
app2
[monitor://xyz.log]
sourcetype=web_log
index=abc
_TCP_ROUTING=HeavyForwarders_1
Hope this helps.
... View more
08-11-2017
10:17 PM
I have not tried this previously, but you could give this a try. Stop splunk services on all instances. :
Make all the configurations in the current instance (before migration) as global with permission to everyone
Clone the default search app to a new app (search_abc)
Move the config files to the cloned app
Once you have moved those to the cloned app, clone the default search app to search_abc (make sure you keep the name same)
Copy the contents of the search_abc from old instance to new instance
Start Splunk instance
... View more
08-04-2017
04:43 PM
1 Karma
Hello All
While upgrading to version 6.6.2 (Indexer Cluster), I noticed that there is a new Status showing like "BatchAdding".
Though this is not much impacting anything, the Splunk upgrade was successful.
Any idea what this means?
... View more
05-25-2017
04:04 AM
@napomokoetle
Please open a new "question" and post it there for users to look into it and respond.
... View more
05-24-2017
04:50 AM
@napomokoetle
Please check whether the connectivity between the instances is normal.
In my case, the connectivity was majorly impacted due from the N/W end.
Once that was resolved, the issue subsided.
... View more
05-24-2017
04:47 AM
This occurred due to the network peripherals failing when trying to communicate to the AWS Instances.
The data from our infrastructure to AWS was being sent in size (2 TBs per day) that the peripheral cannot tolerate the traffic any longer and ended up fluctuating and rebooting the devices.
The N/W team then maximized the data that can be sent across and that fixed the issue.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-20-2026
02:49 AM
|
Karma given to
