Our Primary search head got crashed twice today. When cross verified we found out this is the error message in Crash.log so how should we need to fix it asap. Error Message: Received fatal signal 6 (Aborted). Cause: Signal sent by PID xxx36 running under UID 99xx. Crashing thread: IdataDO_Collector ... View more

Hi Team, We are currently running Splunk Enterprise 6.5 in On-Prem environment. Now we are planning to move them to Azure. So we want to know whether Splunk can be hosted as SAAS in Azure? If yes then kindly let us know how to proceed further. Also if its possible to host in SAAS model then is it very costly? If yes then how much we need to pay for the subscriptions. ... View more

Hi All, Currently we are running with Splunk 6.5.0 (build 59c8927def0f) in our environment with all the servers ( 1Cluster master, 1 Deployment Master, 8 Indexers, 4 Search Heads) getting hosted in Linux box with their respective version(Linux version 2.6.32-696.10.3.el6.x86_64) . So we are planning to upgrade our Splunk Enterprise to the latest version . Hence kindly let us know whether we need to upgrade to Splunk 6.6 and then we need to plan for an upgrade to Splunk 7.0 or Splunk 7.1 versions. Or can we directly upgrade our Splunk Enterprise from 6.5.0 to 7.0 or might be 7.1? Can you kindly let us know which one would be the preferred option or recommended one and also highlight the best practices to achieve the same. We are also eager to know about the Pros and Cons before performing the Upgrade to the latest version. Also kindly provide the steps to upgrade from Splunk 6.5.0 to latest version. ... View more

Hi Team, We have an requirement to monitor the files is getting deleted or modified or added into a folder then we need to get an splunk alert stating that who has modified the file or deleted the folder. Consider an example: We have an shared Drive (D) in a windows server in that we have multiple folders like (A),(B) and (C). In that when we go to folder (A) inside there would be multiple files (might be log file or any other files) like x.log, y.csv and z.xlsx. So we want to get notified if any of the files say (x.log) is getting deleted or modified in that particular folder (A) and we want to know who has deleted or modified the file. Is it possible to achieve in Splunk? If yes kindly let me know how to proceed the same. ... View more

Hi Team, We have allocated 500GB of data per day to index in our environment but everyday the utilization is getting crossed more than 500GB and we have deployed Splunk 6.5 version installed in our environment so generally i can able to pull the report only for last 30 days in our License Usage report which has been configured based on Index, Sourcetype & Host information. But now we want to analyse the trend for last 1 year based on Sourcetype, Index and Host information so that if there is a real need then we will purchase additional license so can you able to help with a search query with the below mentioned key points: --> We need to pull the license utilization report for last 1 year something like that out of 500 GB how much license is getting utilized every day. -->Also we want to segregate the license utilization based on Host, Source and Sourcetype. So it would be really helpful if you can able to provide me the search query or a way to extract the report. ... View more

Hi Team, I got a scenario as below: index=* host=A or host=B Type=Info "Service down" In this i want the following thing needs to be achieved. 1.) If host A or host B service is down then it needs to send a warning alert in Hipchat. 2.)Next condition is that if both Host A as well as Host B service is down then it needs to send a critical alert to Hipchat. Can i know whether it can be achieved in a single query itself? So if not, then if we need to create two alerts separately then anyhow in Hipchat it will trigger two alerts but our requirement is only one. Either any one of the server is down then go as warning if both is down it needs to go as critical but it needs to be only one alert. Kindly note we have already configured Hipchat in our environment and integrated to Splunk. So i just need help in the search query. And also let me know whether it can be achieved, ... View more

Hi Team, We got a request to enable x_frame_options_sameorigin = [False] . Since currently they couldn't able to view the same in Iframe. So Would there be a config available to keep the security, though allow ONLY a specific address? I.E.: Keep the setting "x_frame_options_sameorigin = [True ]" with an exception set to allow any URL string like "https://..com" Another query is that by any chance can we can change x_frame_options_sameorigin property to support“X-Frame-Options: ALLOW-FROM https://..com/”? something like that In Which path of the search head server should we need to edit the web.conf file. So will try the same from our end and check whether its working fine or not. A ... View more

Hi Team, In our environment, We have all apps in our deployment server and from there we used to deploy it so that it will reach all our indexers. Currently, we have an app in our deployment server and in that we have inputs.conf (/opt/splunk/etc/deployment-apps/appname/local/inputs.conf) and in that we want to blacklist a server in inputs.conf This is the sample like Inputs.conf file: [monitor:///xx/xx/Xxx/xxxx/xxxx.*] sourcetype = xxxxxx blacklist = (servername) index = xxxx disabled = 0 So in this stanza I have mentioned the servername under blacklist= (servername) but still the logs are getting ingested into Splunk for those index and sourcetype. So how to blacklist the server in inputs.conf So kindly let me know how to fix the same. ... View more