I made some changes to some properties files on my deployment server:
etc/system/local/serverclass.conf - added a new client
deployed. Seem to still work
then I added a blacklist
etc/apps/deployment-apps/splunk_ta_windows - added a blacklist
deployed, it and things seemd to stop working. Everything, couldn't search for current day
I had a space issue on my forwarder, which I resolved.
I see this error on my indexer now:
Truncating line because limit of 10000 bytes has been exceeded with a line length >= 11576 - data_source="/trvapps/splunk/var/log/splunk/remote_searches.log", data_host="tospkiu1", data_sourcetype="splunkd_remote_searches"
... View more