Hi Somesoni2, I am getting an error while executing the above mentioned query error details : Error in 'TsidxStats': _time aggregations are not yet supported except for min/max we are using the splunk 6.0.3 version ... View more

Hi All, Can anyone help us in getting this issue fixed, as we could see data being stopped indexing from sourcetype=opsec from yesterday and not sure about the exact problem causing this issue. Kindly let guide us in troubleshoot this issue. thanks in advance. ... View more

Hi All, Can anyone guide us in fixing the above mentioned issue and when checked in to OPSEC_Watchdog.log, we could see the below message. 2017-03-05 10:59:20,548 INFO 1688 139958523827968 process exited normally 2017-03-05 10:59:23,361 INFO 2835 140297693193984 Starting exec: ./lea_loggrabber 2017-03-05 10:59:23,631 INFO 2835 140297693193984 process crashed (1), restarting 2017-03-05 10:59:28,903 INFO 7755 140402351773440 Starting exec: ./lea_loggrabber 2017-03-05 10:59:28,957 INFO 27083 140187540715264 Starting exec: ./lea_loggrabber 2017-03-05 10:59:28,968 INFO 15517 140587990456064 Starting exec: ./lea_loggrabber 2017-03-05 10:59:29,110 INFO 7755 140402351773440 process crashed (1), restarting 2017-03-05 10:59:29,186 INFO 27083 140187540715264 process crashed (1), restarting 2017-03-05 10:59:29,255 INFO 15517 140587990456064 process crashed (1), restarting kindly guide us in fixing this issue thanks in advance. ... View more

Hi Rjthibod, thanks for providing some inputs to capture the source which had consumed large amount of license for past 24 hours. I have modified as per our requirement and got the expected output. index=_internal source=license_usage.log type="Usage" idx=* | stats sum(b) as bytes by host source sourcetype idx | eventstats sum(bytes) as TotalSourcetype by sourcetype | eventstats sum(bytes) as TotalSource by source | eventstats sum(bytes) as TotalIndex by idx | eventstats sum(bytes) as TotalHost by host | eval Mbytes=bytes/(1024*1024) | sort -TotalSource Mbytes | eventstats sum(Mbytes) as Totalcount by sourcetype | eval P=round((Mbytes/Totalcount*100),2)|eval Percentage=P+" "+"%" | table host source sourcetype idx Mbytes Percentage | sort - Percentage ... View more

Hi All can any one provide a query to find out the source which had consumed large amount of license for past 24 hours. thanks in advance. ... View more

Is there any query which I can execute and get the required result, as I dnt have an access to that license manager. so could you please share me the query to find out the source which had consumed large amount of license for past 24 hours. thanks in advance. ... View more

thanks jkat54, could you please share me the steps on how to narrow down an ldap strategy to a single user using filters. Already there other users present in the Admin LDAP group, will this user get affected. thanks in advance. ... View more

Thanks Somesoni2, In our case we need to assign an admin role to an existing user called test who is already assigned with basic user profile. When checked in Splunkweb --access control -- Authentication method -- configuration splunk to use LDAP and Map groups -- Manage group -- LDAP group (admin) So how to add the test user under this LDAP group ? Also where to find out authentication.conf file in splunk home path ? thanks in advance. ... View more

Hi All, Can anyone throw me some lights on this error . thanks in advance. ... View more

hi rroberts, thanks for sharing some document, as I had told we do not have much idea on REST API, so kindly guide me what I need to look in the document which you had shared as it got lots of information and the same time if you can share me the steps to trouble shoot this issues instead of sharing the documents. unable to understand the example which you had shared in your comments, so kindly guide us what exactly we need to follow to fix this issue. thanks in advance. ... View more

Hi lguinn, can you provide us steps on how to reduce the size of the index. thanks in advance. ... View more

Hi lguinn, thanks for your response but I think these are the splunk internal index data that are present in the splunk search head under this folder /opt/splunk/var/lib/splunk/ audit_db , not sure why it is configured like this. when I tried to execute this command find -name indexes.conf | xargs grep access_summarydb in search head instance, I have got this output. ./SA-AccessProtection/default.old.20140313-215106/indexes.conf:homePath = $SPLUNK_DB/access_summarydb/db ./SA-AccessProtection/default.old.20140313-215106/indexes.conf:coldPath = $SPLUNK_DB/access_summarydb/colddb ./SA-AccessProtection/default.old.20140313-215106/indexes.conf:thawedPath = $SPLUNK_DB/access_summarydb/thaweddb ./SA-AccessProtection/default.old.20150226-133140/indexes.conf:homePath = $SPLUNK_DB/access_summarydb/db ./SA-AccessProtection/default.old.20150226-133140/indexes.conf:coldPath = $SPLUNK_DB/access_summarydb/colddb ./SA-AccessProtection/default.old.20150226-133140/indexes.conf:thawedPath = $SPLUNK_DB/access_summarydb/thaweddb ./SA-AccessProtection/default/indexes.conf:homePath = $SPLUNK_DB/access_summarydb/db ./SA-AccessProtection/default/indexes.conf:coldPath = $SPLUNK_DB/access_summarydb/colddb ./SA-AccessProtection/default/indexes.conf:thawedPath = $SPLUNK_DB/access_summarydb/thaweddb ./SplunkPCIComplianceSuiteInstaller/default.old.20150226-132847/src/etc/apps/SA-AccessProtection/default/indexes.conf:homePath = $SPLUNK_DB/access_summarydb/db Not sure what I need to do exactly to reduce the size, I am confused now and worried how to fix this now. I thought of changing the space in Splunk portal -->setting-->indexes -->audit & access_summarydb both Max Size for entire index = 500000 MB to 300000 MB. So kindly let provide us some steps to fix this issue that will be really help me in resolving this issues. thanks in advance. ... View more

Hi All, Can any one guide us in getting this issue fixed as we are running short of space in prod environment. Can we change the Max Size for entire index from 500000 to 300000 MB will this reduce the size of the index ? What will be the impact if we reduce the index size from 500000 to 300000 MB. thanks in advance. ... View more

Hi All, Can any one guide us in getting this issue fixed as we are finding space crunch to manage it. Below are the settings configured : From Splunk portal -->setting-->indexes -->audit & access_summarydb both has below setting configured. Max Size for entire index = 500000 MB Max Size (MB) /hot/warm/cold bucket are set to auto Frozen archive path is not set Currently the size of the audit_db indexes is 30GB & access_summarydb is 51 GB, so kindly let me know how to reduce the size as I am finding very difficult to manage the space in prod environment. thanks in advance. ... View more

Hi lguinn, thanks for the information but when I executed the below command it did not move the file to tmp folder , instead it was throwing the below message not sure why I am getting this message when I had followed these steps. bash-4.1$ ./splunk cmd splunkd clean-dispatch /tmp -24@h Could not move /opt/splunk/var/run/splunk/dispatch/scheduler__admin_U0EtQWNjZXNzUHJvdGVjdGlvbg__RMD5203a2beee6037c4b_at_1484110500_46277 to /tmp/scheduler__admin_U0EtQWNjZXNzUHJvdGVjdGlvbg__RMD5203a2beee6037c4b_at_1484110500_46277. Invalid cross-device link Could not move /opt/splunk/var/run/splunk/dispatch/scheduler__nobody_VEEtZmlyZV9icmlnYWRl__RMD55aaa2df2491d4b84_at_1484110740_48552 to /tmp/scheduler__nobody_VEEtZmlyZV9icmlnYWRl__RMD55aaa2df2491d4b84_at_1484110740_48552. Invalid cross-device link Could not move /opt/splunk/var/run/splunk/dispatch/scheduler__admin_U0EtQWNjZXNzUHJvdGVjdGlvbg__RMD51b34e21c24086dff_at_1484110500_46280 to /tmp/scheduler__admin_U0EtQWNjZXNzUHJvdGVjdGlvbg__RMD51b34e21c24086dff_at_1484110500_46280. Invalid cross-device link And also I could see most of the files under dispatch directory are more recent one, only two directory files are older then a day or 2, so is that fine to clean the dispatch directory . /opt/splunk/var/run/splunk/dispatch drwx------ 2 splunk splunk 4096 Jan 11 00:35 scheduler__admin_U0EtQXVkaXRBbmREYXRhUHJvdGVjdGlvbg__RMD50309564ea6190f59_at_1484111700_52239 drwx------ 2 splunk splunk 4096 Jan 11 00:35 scheduler__admin_U0EtQXVkaXRBbmREYXRhUHJvdGVjdGlvbg__RMD50309564ea6190f59_at_1484112600_52280 drwx------ 2 splunk splunk 4096 Jan 11 00:45 scheduler__admin_U0EtQXVkaXRBbmREYXRhUHJvdGVjdGlvbg__RMD50309564ea6190f59_at_1484113500_57195 drwx------ 4 splunk splunk 4096 Jan 11 00:40 scheduler__admin_U0EtQXVkaXRBbmREYXRhUHJvdGVjdGlvbg__RMD5299817463118a981_at_1484113200_55048 drwx------ 4 splunk splunk 4096 Jan 11 00:45 **scheduler__admin_U0EtQXVkaXRBbmREYXRhUHJvdGVjdGlvbg__RMD5299817463118a981_at_1484113500_57194 drwx------ 3 splunk splunk 4096 Jan 9 23:59** **scheduler__nobody_VEEtZmlyZV9icmlnYWRl__RMD55aaa2df2491d4b84_at_1484024340_67342 drwx------ 3 splunk splunk 4096 Jan 10 23:59** scheduler__nobody_VEEtZmlyZV9icmlnYWRl__RMD55aaa2df2491d4b84_at_1484110740_48552 drwx------ 4 splunk splunk 4096 Jan 11 00:45 subsearch_scheduler__nobody_U3BsdW5rX2Zvcl9FeGNoYW5nZQ__RMD53fdff49fe21aa77e_at_1484113500_57179_1484113503.1 drwx------ 2 splunk splunk 4096 Jan 11 00:40 scheduler__nobody__r__RMD53dc0a2d72b392d26_at_1484113200_55030 drwx------ 2 splunk splunk 4096 Jan 11 00:45 scheduler__nobody__r__RMD53dc0a2d72b392d26_at_1484113500_57177 Please let me know whether we need to stop and move the file from this folder and how to setup a monitoring to monitor the size of the dispatch directory in splunk using a splunk query. thanks in advance. ... View more