Hi Woodcock How can i reach the splunk sales team? ... View more

Hi Miteshvohra splunk.license is the license i got only for extending a disk space from 500mb/day to 5gb/day and my trial period is still active. ... View more

hi MuS I am using splunk free, i head 5 hard warnings before when i was still under 500MB/day and the disk space now is 5GB/day after splunk.license file installation but i am still under violation, i can not do anything. ... View more

i am talking about syslog server ... View more

hi Mus i need your help. i did the calculations as you said and it worked perfectly i now know the disk space for my server but now since the company wants to assign me a syslog server for the splunk to use..they also want to know the Core CPU and RAM required for my server...is this important? if so please help how can i approach it to find the RAM and CPU required for my sever? thanks ... View more

thanks how can i save the disc space on my syslog sever lets say i just want to check and reset my logs in every 3 moths period in a sever...is that possible? ... View more

i am running a full splunk enterprise in a linux server that get logs from all switches. can you please elaborate more on your first line i dont understand it. thanks martin ... View more

Thanks Joe for your time i have i more question thou, as i want to monitor more than 100 network switches each under the same sourcetype but each switch obviously has unique host ip address is it possible to do like this below: [monitor:///var/log/H3C/information] disabled=false sourcetype=syslog_wisdom host=172.17.101.8 host=172.17.101.7 host=172.17.101.9 ... Thanks ... View more

i only see this inside my inputs.conf ... [monitor: ///var/log/H3C/information] disabled = false sourcetype = syslog_wisdom And i dont see any host value or do i have to just add the line like below after sourcetype... host = 192.168.1.254 ... View more

thank you richgalloway ... View more

hi martin_mueller i always here this but i dont know why is not a good practice. can you please explain to me why is not a good practice in simple terms thank in advance ... View more

i get this [root@localhost wisdom.network_trainee]# strace /opt/splunk/bin/splunk start execve("/opt/splunk/bin/splunk", ["/opt/splunk/bin/splunk", "start"], [/* 39 vars */]) = -1 ENOEXEC (Exec format error) dup(2) = 3 fcntl(3, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE) fstat(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9bc4c17000 lseek(3, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) write(3, "strace: exec: Exec format error\n", 32strace: exec: Exec format error ) = 32 close(3) = 0 munmap(0x7f9bc4c17000, 4096) = 0 exit_group(1) = ? Thanks ... View more

Thanks Mus please advise me what to do from this point far because i feel like i am stacked 😞 thanks ... View more

hi Mus i find this : [root@localhost wisdom.network_trainee]# find /opt/splunk/ | wc -l 12750 [root@localhost wisdom.network_trainee]# du -sk /opt/splunk/ 1575340 /opt/splunk/ ... View more

i am running a free licence for now... ... View more

hi n00badmin From the look of things my system is healthy thou: Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_wisdom-lv_root 50G 3.8G 45G 8% / tmpfs 1.9G 376K 1.9G 1% /dev/shm /dev/sda1 477M 98M 354M 22% /boot /dev/mapper/vg_wisdom-lv_home 176G 18G 149G 11% /home ... View more

yeah this was the last time 06-19-2015 16:50:44.608 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_introspection/db/db_1433497801_1433466532_39' after this i was not able to enter splunk web ... View more

[root@localhost wisdom.network_trainee]# cd /opt/splunk/var/log/splunk/ [root@localhost splunk]# tail -50 splunkd.log 06-18-2015 10:40:47.859 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason='Removing bucket, bid=_internal~26~414C0929-B95F-4C97-A4BB-AB1267F53365' 06-18-2015 10:40:47.890 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432006804_1431942980_26' 06-18-2015 10:40:48.839 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason=' frozen_buckets' 06-18-2015 10:41:44.726 +0700 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/splunk/var/log/splunk/metrics.log'. 06-18-2015 10:41:44.864 +0700 INFO WatchedFile - Will begin reading at offset=24992205 for file='/opt/splunk/var/log/splunk/metrics.log.1'. 06-18-2015 10:42:48.840 +0700 INFO BucketMover - will attempt to freeze: candidate='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432006922_1432006809_27' because frozenTimePeriodInSecs=2592000 exceeds difference between now=1434598968 and latest=1432006922 06-18-2015 10:42:48.843 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason='Removing bucket, bid=_internal~27~414C0929-B95F-4C97-A4BB-AB1267F53365' 06-18-2015 10:42:48.847 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432006922_1432006809_27' 06-18-2015 10:42:49.832 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason=' frozen_buckets' 06-18-2015 15:16:56.840 +0700 INFO BucketMover - will attempt to freeze: candidate='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432023396_1432006926_28' because frozenTimePeriodInSecs=2592000 exceeds difference between now=1434615416 and latest=1432023396 06-18-2015 15:16:56.841 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason='Removing bucket, bid=_internal~28~414C0929-B95F-4C97-A4BB-AB1267F53365' 06-18-2015 15:16:56.867 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432023396_1432006926_28' 06-18-2015 15:16:57.832 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason=' frozen_buckets' 06-18-2015 17:03:47.839 +0700 INFO BucketMover - will attempt to freeze: candidate='/opt/splunk/var/lib/splunk/_introspection/db/db_1433412195_1433380011_38' because frozenTimePeriodInSecs=1209600 exceeds difference between now=1434621827 and latest=1433412195 06-18-2015 17:03:47.842 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_introspection/db'. Reason='Removing bucket, bid=_introspection~38~414C0929-B95F-4C97-A4BB-AB1267F53365' 06-18-2015 17:03:47.862 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_introspection/db/db_1433412195_1433380011_38' 06-18-2015 17:03:58.837 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_introspection/db'. Reason=' frozen_buckets' 06-18-2015 17:08:36.835 +0700 INFO BucketMover - will attempt to freeze: candidate='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432030087_1432023400_29' because frozenTimePeriodInSecs=2592000 exceeds difference between now=1434622116 and latest=1432030087 06-18-2015 17:08:36.835 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason='Removing bucket, bid=_internal~29~414C0929-B95F-4C97-A4BB-AB1267F53365' 06-18-2015 17:08:36.844 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432030087_1432023400_29' 06-18-2015 17:08:37.831 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason=' frozen_buckets' 06-19-2015 00:00:00.831 +0700 INFO LMStackMgr - should rollover=true because _lastRolloverTime=1434560400 lastRolloverDay=1434560400 snappedNow=1434646800 06-19-2015 00:00:00.832 +0700 INFO LMStackMgr - quotaExceededCount=0, lastExceedDate=0, peak=0, rolloverCount=1, totalCumulativeBytesAtRollover=0, todaysBytesIndexed=0, licenseSize=524288000 06-19-2015 00:00:00.832 +0700 INFO LMStackMgr - finished rollover, new lastRolloverTime=1434646800 06-19-2015 00:00:03.831 +0700 INFO LMSlaveInfo - Detected that masterTimeFromSlave(Thu Jun 18 23:59:02 2015) < lastRolloverTime(Fri Jun 19 00:00:00 2015), meaning that the master has already rolled over. Ignore slave persisted usage. 06-19-2015 07:36:27.586 +0700 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/splunk/var/log/introspection/resource_usage.log'. 06-19-2015 07:36:27.668 +0700 INFO WatchedFile - Will begin reading at offset=24998813 for file='/opt/splunk/var/log/introspection/resource_usage.log.1'. 06-19-2015 09:24:41.898 +0700 INFO WatchedFile - Will begin reading at offset=0 for file='/opt/splunk/var/log/splunk/metrics.log'. 06-19-2015 09:24:42.020 +0700 INFO WatchedFile - Will begin reading at offset=24997732 for file='/opt/splunk/var/log/splunk/metrics.log.1'. 06-19-2015 10:42:14.568 +0700 ERROR HTTPClient - Cannot resolve IP of host=apps.splunk.com: Temporary failure in name resolution 06-19-2015 10:42:14.568 +0700 ERROR ApplicationUpdater - Error checking for update, URL=/api/apps:resolve/checkforupgrade: Invalid URI 06-19-2015 10:51:20.832 +0700 INFO LMStackMgr - should rollover=true because _lastRolloverTime=1434646800 lastRolloverDay=1434560400 snappedNow=1434646800 06-19-2015 10:51:20.832 +0700 INFO LMStackMgr - quotaExceededCount=0, lastExceedDate=0, peak=0, rolloverCount=2, totalCumulativeBytesAtRollover=0, todaysBytesIndexed=0, licenseSize=524288000 06-19-2015 10:51:20.832 +0700 INFO LMStackMgr - finished rollover, new lastRolloverTime=1434685880 06-19-2015 10:51:48.586 +0700 WARN TimeoutHeap - Detected system time adjusted backwards by 11245ms. 06-19-2015 10:51:48.663 +0700 WARN TimeoutHeap - Detected system time adjusted backwards by 11244ms. 06-19-2015 10:51:48.747 +0700 WARN TimeoutHeap - Detected system time adjusted backwards by 11244ms. 06-19-2015 10:51:48.765 +0700 WARN TimeoutHeap - Detected system time adjusted backwards by 2326ms. 06-19-2015 10:51:48.908 +0700 WARN IntrospectionGenerator:resource_usage - TimeoutHeap - Detected system time adjusted backwards by 7247ms. 06-19-2015 10:51:48.908 +0700 WARN TimeoutHeap - Detected system time adjusted backwards by 7247ms. 06-19-2015 10:51:52.849 +0700 WARN TimeoutHeap - Detected system time adjusted backwards by 2246ms. 06-19-2015 10:51:52.849 +0700 WARN TimeoutHeap - Detected system time adjusted backwards by 2246ms. 06-19-2015 10:52:16.584 +0700 INFO LMSlaveInfo - Detected that masterTimeFromSlave(Fri Jun 19 10:51:15 2015) < lastRolloverTime(Fri Jun 19 10:51:20 2015), meaning that the master has already rolled over. Ignore slave persisted usage. 06-19-2015 13:41:17.605 +0700 INFO BucketMover - will attempt to freeze: candidate='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432104061_1432030091_30' because frozenTimePeriodInSecs=2592000 exceeds difference between now=1434696077 and latest=1432104061 06-19-2015 13:41:17.606 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason='Removing bucket, bid=_internal~30~414C0929-B95F-4C97-A4BB-AB1267F53365' 06-19-2015 13:41:17.629 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_internaldb/db/db_1432104061_1432030091_30' 06-19-2015 13:41:18.585 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_internaldb/db'. Reason=' frozen_buckets' 06-19-2015 16:50:44.599 +0700 INFO BucketMover - will attempt to freeze: candidate='/opt/splunk/var/lib/splunk/_introspection/db/db_1433497801_1433466532_39' because frozenTimePeriodInSecs=1209600 exceeds difference between now=1434707444 and latest=1433497801 06-19-2015 16:50:44.605 +0700 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/_introspection/db'. Reason='Removing bucket, bid=_introspection~39~414C0929-B95F-4C97-A4BB-AB1267F53365' 06-19-2015 16:50:44.608 +0700 INFO BucketMover - AsyncFreezer freeze succeeded for bkt='/opt/splunk/var/lib/splunk/_introspection/db/db_1433497801_1433466532_39' ... View more

[root@localhost wisdom.network_trainee]# find / -name splunk /etc/rc.d/init.d/splunk /opt/splunk /opt/splunk/lib/python2.7/site-packages/splunk /opt/splunk/share/splunk /opt/splunk/share/splunk/search_mrsparkle/exposed/js/splunk /opt/splunk/share/splunk/search_mrsparkle/exposed/img/splunk /opt/splunk/bin/splunk /opt/splunk/var/log/splunk /opt/splunk/var/run/splunk /opt/splunk/var/lib/splunk /opt/splunk/var/spool/splunk /var/lock/subsys/splunk /var/spool/mail/splunk ... View more