Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About SinghK
SinghK
Builder
Member since:
11-10-2020
04-22-2025
Community Statistics
| Posts | 243 |
| Solutions | 13 |
| Karma Given | 11 |
| Karma Received | 36 |
| Member Since | 11-10-2020 |
Activity Feed
- Posted Re: Why do I need to unbind the mgmt port in order to restart splunk? on Deployment Architecture. 06-19-2024 04:24 AM
- Posted Re: Splunk Agent Install Issue - Error: The system cannot find the path specified. on Getting Data In. 01-18-2024 01:59 AM
- Posted Re: Splunk Agent Install Issue - Error: The system cannot find the path specified. on Getting Data In. 01-17-2024 04:59 AM
- Posted Re: How to extract a field value which have combination of number and special characters? on Splunk Search. 01-17-2024 04:56 AM
- Posted Re: How to find which indexes are used? on Splunk Search. 01-17-2024 04:44 AM
- Posted Re: Splunk Universal Forwarder not starting after rebooting on Splunk Enterprise. 10-13-2023 03:16 AM
- Posted Re: Splunk Universal Forwarder not starting after rebooting on Splunk Enterprise. 10-13-2023 03:14 AM
- Posted Re: Cannot getting data into indexes on Splunk Enterprise. 10-13-2023 03:07 AM
- Posted Re: Cannot getting data into indexes on Splunk Enterprise. 10-13-2023 03:06 AM
- Posted Re: forward indexes to different port of the same server on Getting Data In. 09-05-2023 12:42 AM
- Tagged Re: forward indexes to different port of the same server on Getting Data In. 09-05-2023 12:42 AM
- Posted Re: How to resolve error when installing Splunk Credentials Package (splunkclouduf.spl)? on Installation. 06-06-2023 07:15 AM
- Posted Re: How to resolve error when installing Splunk Credentials Package (splunkclouduf.spl)? on Installation. 06-06-2023 07:01 AM
- Posted Re: How to resolve error when installing Splunk Credentials Package (splunkclouduf.spl)? on Installation. 06-06-2023 06:56 AM
- Posted Re: Analytic Story: Domain Account Discovery With Net App on Splunk Enterprise Security. 06-06-2023 06:44 AM
- Posted Re: How to upload files to Splunk server to use in dashboard source xml code? on Dashboards & Visualizations. 06-06-2023 06:40 AM
- Posted Re: Is there an easy way to tell what role a spunk server is? on Security. 06-06-2023 06:33 AM
- Karma Re: Is there an easy way to tell what role a spunk server is? for inventsekar. 06-06-2023 06:32 AM
- Got Karma for Re: How can I find the data retention and indexers involved?. 06-01-2023 06:56 AM
- Posted Re: How can I find the data retention and indexers involved? on Splunk Search. 06-01-2023 06:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-24-2022
10:12 AM
Then just restart the cluster once. clear the messages and see if new messages come back in.
... View more
05-24-2022
09:03 AM
Apologies my bad, it’s opt/splunk/etc/slave-apps on indexers. you need to find your apps which configured indexes and check if it got updated.
... View more
05-24-2022
08:54 AM
By slaves I meant cluster nodes.
... View more
05-24-2022
08:53 AM
Once you do that you can check if all has replicated to slaves. By going to /opt/etc/apps/slave-apps /your app and check of the indexes.conf has the settings as on master app
... View more
05-24-2022
07:49 AM
i have seen this in other environments too.. let me see if i can get the attention to this, seems like a never ending issue.
... View more
05-24-2022
05:38 AM
Have you by any chance upgraded to 8.2.5 if yes then IOPS values are a bit sensitive.
... View more
05-24-2022
12:35 AM
Try and check DS logs and see if you can find an error related to ssl for that forwarder this will confirm its due to ssl.
... View more
05-12-2022
03:35 AM
hi All,
Though i have set frozenTimePeriodInSecs to a year on a cluster, the logs are only getting retained till 90 days max
same settings in other cluster is working fine. need some help checking the issue.
thanks in advance,
... View more
Labels
- Labels:
-
troubleshooting
05-12-2022
03:28 AM
Logs are in /opt/splunkforwarder/var/log/splunk directory or if you are getting internal logs then index=_internal host=<your host> sourcetype= splunkd should give you the logs check if you see any errors
... View more
05-10-2022
02:12 AM
did you check splunkd.logs for the forwarder ? any errors? and @gcusello informed about modifying the input you created, have you done it ?
... View more
05-10-2022
02:03 AM
did you try searching it with time set to all time instead of a specific time filter.
... View more
04-27-2022
01:45 AM
Then you need a extra server there is no other way to deploy a HF or you can do is remove one of your SH and make it a Heavy Forwarder. Thats all I can think of...
... View more
04-27-2022
01:16 AM
is it a specific requirement that you need 4 SH in your environment?
... View more
04-21-2022
03:15 AM
Normally they send a couple of files when they send license just check if you have added correct file.
... View more
04-20-2022
01:00 AM
Check this link: https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-error-quot-ERROR-TcpInputProc-Error-encountered/m-p/282666
... View more
04-17-2022
11:53 PM
x to x and y to y
... View more
04-17-2022
11:41 PM
1 Karma
for more info check this post out https://community.splunk.com/t5/Getting-Data-In/How-to-forward-logs-from-universal-forwarders-to-heavy/m-p/251645
... View more
04-17-2022
11:38 PM
Then create a normal output.conf on uf and point it to hf and on hf create input similar to indexers [Splunktcp://: port ] Rest of your input config And hf is already connected to indexers so it should start sending data. Use props on hf to filter data and a should be set.
... View more
04-17-2022
11:32 PM
Well the first question is why are you connecting UF to hf is there a specific requirement as UF can connect directly to indexers or cluster.
... View more
04-17-2022
10:27 PM
Is the port working between new indexer and uf ? Do you see any communication? Do you see any logs in index =_internal?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-22-2025
06:31 AM
|
Karma given to
