Hi Upgrade from splunk-7.3.1 to splunk-8.1.1 have some issue:   1-when I going to "search page" at this url http://IP:9000/app/search/search suddenly service stopped! I can't find any clue from logs. FYI when I going to other page service not fail and work correctly, but on search page stopped! 2-give this error (i try to change password as mention here but service still crash) TailReader-0 Root Cause(s): The monitor input cannot produce data because splunkd's processing queues are full. This will be caused by inadequate indexing or forwarding rate, or a sudden burst of incoming data. Last 50 related messages: 03-04-2021 21:23:44.451 +0330 WARN TailReader - Could not send data to output queue (parsingQueue), retrying... 03-04-2021 21:23:38.011 +0330 INFO TailReader - State transitioning from 1 to 0 (initOrResume). 03-04-2021 21:23:38.011 +0330 INFO TailReader - State transitioning from 1 to 0 (initOrResume). 03-04-2021 21:23:38.007 +0330 INFO TailReader - batchreader0 waiting to be un-paused 03-04-2021 21:23:38.007 +0330 INFO TailReader - Starting batchreader0 thread 03-04-2021 21:23:38.007 +0330 INFO TailReader - Registering metrics callback for: batchreader0 03-04-2021 21:23:38.005 +0330 INFO TailReader - tailreader0 waiting to be un-paused 03-04-2021 21:23:38.005 +0330 INFO TailReader - Starting tailreader0 thread 03-04-2021 21:23:38.004 +0330 INFO TailReader - Registering metrics callback for: tailreader0   Any idea? Thanks, ... View more

Hi I create simple dropdown list on dashboard.   Now I want to modify query with this dropdown list  e.g. my dropdown list: APP1, APP2, APP3,... my query: index="myindex" source="/data/APP1"   when I select APP2 query change to this  index="myindex" source="/data/APP2"   FYI: I don't want to use field or any think else just directly modify query   Any Idea? Thanks, ... View more

Hi I want to gather log file of several machine that performance of those machine really important for me, now these question come to my mind. 1-when i use forwarder how much of resource use by splunk forwarders?(i know it depend to lots of parameters but need to know approximately how much estimation) 2-is it better to use syslog to gather log in centralize server after that splunk analyze them? (Splunk forwarder compress and encrypt logs when send it to log server that use resources) 3-any best practice or use case exist for this aim?   Thanks, ... View more

Hi I copy several log file in this path /opt/logs/ add directory to Splunk, all file index and import to Splunk expect single log file with 15GB size! any idea? Thanks, ... View more

Hi  I have log files on this path /opt/logs/* add them to splunk and create index for this path, but when I  search with source=“/opt/logs/*” no result return. when i use index=“My-indexname” return result.   any idea? Thanks, ... View more

Hi I have several log files that add to Splunk, now try to search this string: index="Myindex" | search "HQL query plan in cache (select i from table1 i where" splunk return 198 events but when i try to grep on the shell return 242!   FYI 1: time scope set to “all time” FYI 2: index process completed. Thanks,   ... View more

Hi I try to install forwarder in rhel 7, add jboss log path to forward splunk server, but no have performance issue. 1-what type of solution can apply here? 2-tune forwarder? 3-set interval for forwarder that when send data to server e.g. every 60 min? 4-try to send data to splunk server through udp? any idea? ... View more

I have log file like this,want regex everything after last colon in each line input: 2020-06-28 15:03:32 , 710 ERROR In--111111 [ Processor ] FATAL: exception in process: javax.RollbackException: ARJUNA016053: Could not commit .   2020-06-28 14:24:41 , 322 ERROR In--111111 [ Processor ] FATAL: exception in process: [ GG_010 ] Failed >> 0060:   required to perform this operation ( extended persistence context).   2020-06-28 15:03:32,710 ERROR In--111111 [Processor] FATAL: exception in process: javax.RollbackException: ARJUNA016053:Could not update.   output: Could not commit required to perform this operation (extended persistence context) Could not update   Thanks ... View more

Hi I have log file that copy on splunk server every day with below structure: /data/appserver/ACC/20200617/log.customer1.20200617.bz2 /data/appserver/ACC/20200617/log.customer2.20200617.bz2 /data/appserver/ACC/20200617/log.cus1.20200617.bz2 /data/appserver/ACC/20200617/log.cus2.20200617.bz2 /data/appserver/ACC/20200617/log.cus3.20200617.bz2 now I want splunk consider everything between two dots as host name, like this: customer1 customer2 cus1 cus2 cus3 I try to do this throgh web ui and "Set host" = "5" : settings > datainputs > Files & Directories > /data/appserver/ACC/ is this correct? i mean splunk consider 5's part of address?   Thanks ... View more

Hi I create report and share with users (join to ldap server). they can see report but when click on numbers that show on table do not have result. while admin user do the same thing and result load successfully. FYI: 1-give read permission to all users. 2-report run as report owner. 3-give permission to users to access index. 4-give permission to users to access data model. 5-inspect job : INFO UserManager - Unwound user context: myuser-> NULL 6-As you see i have 2 search, when user delete whatever exist in second search users able to see events. Any idea? ... View more