Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About btshivanand
btshivanand
Path Finder
Member since:
06-01-2020
04-13-2022
Community Statistics
| Posts | 52 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 06-01-2020 |
Activity Feed
- Got Karma for I see this error in my search head Low Level HTTP request failure err=failed method=POST path=/. 04-28-2022 06:26 AM
- Posted Indexing delays due the monitor input cannot produce data because splunkd's processing queues are full. on Installation. 01-21-2022 11:36 PM
- Posted Can any one help me to generate self signed certification on windows universal forwarder? on Splunk Enterprise. 10-18-2021 04:52 AM
- Posted can any one help me with step by step ssl configuration from UF to HF and HF to Indexers? on Security. 10-10-2021 03:18 AM
- Posted Shall we upgrade splunk clustered environment from 8.0.3 to 8.2.2 on Installation. 09-28-2021 03:52 AM
- Posted Re: Splunk uprdation from 8.0.3 to 8.2.2 on Installation. 09-19-2021 08:35 PM
- Posted Splunk uprdation from 8.0.3 to 8.2.2 on Installation. 09-19-2021 04:03 AM
- Posted CSV max results to email? on Reporting. 08-11-2021 02:48 AM
- Posted I see this error in my search head Low Level HTTP request failure err=failed method=POST path=/ on Deployment Architecture. 06-29-2021 01:36 AM
- Posted I see error in Low Level HTTP request failure err=failed method=POST in search head cluster on Splunk Search. 06-29-2021 01:02 AM
- Posted web ssl for 2 splunk domains on Getting Data In. 06-28-2021 12:12 AM
- Posted /opt/ee_splunk/splunk/etc/apps/splunk_essentials_8_2/default/app.conf' changed. in SHC on Getting Data In. 06-22-2021 11:22 PM
- Posted Setting up self signed ssl communication splunk clsuster on Getting Data In. 06-20-2021 11:53 PM
- Posted Re: Search member are not appearing in monitoring console on Deployment Architecture. 06-18-2021 07:20 AM
- Posted Re: Search member are not appearing in monitoring console on Deployment Architecture. 06-18-2021 02:35 AM
- Posted Re: Search member are not appearing in monitoring console on Deployment Architecture. 06-18-2021 02:28 AM
- Posted Re: Search member are not appearing in monitoring console on Deployment Architecture. 06-18-2021 01:29 AM
- Posted Re: Search member are not appearing in monitoring console on Deployment Architecture. 06-16-2021 08:05 AM
- Posted Re: Search member are not appearing in monitoring console on Deployment Architecture. 06-16-2021 08:02 AM
- Posted Search member are not appearing in monitoring console on Deployment Architecture. 06-16-2021 03:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
11-02-2020
05:47 AM
trigger condition is send email.please find the above screen shot you see where nonzero counts are exceeding 5.
... View more
11-01-2020
10:05 PM
What is the exact text of the error message(s) you receive? I see below error in search head captain and status show as red. Root Cause(s): The percentage of high priority searches delayed (11%) over the last 24 hours is very high and exceeded the red thresholds (10%) on this Splunk instance. Total Searches that were part of this percentage=100. Total delayed Searches=11 Last 50 related messages: Did anything else change besides the version of Splunk? We have not changed anything after version upgrade. What is you Splunk environment like (single instance, cluster, etc.)? Our environment is in cluster..4 indexer 3 search head 1 deployer 1 matster When you say the custom alerts are "not working" what exactly do you mean? What are the symptoms? Are they running at all? Have you checked the search log for the alerts? Custom alert conditions are not working. I have investigated scheduler log. I could see that status is success alert action is blank.one user raised the concern that alert is not triggering when the custom condition are met. Later we realized that its not working with all the alerts which are using custom condition. 10-31-2020 08:10:07.566 +0000 INFO SavedSplunker - savedsearch_id="XXX;search; alert", search_type="", user="XXX", app="search", savedsearch_name="XXXX alert", priority=default, status=success, digest_mode=1, scheduled_time=1604131800, window_time=0, dispatch_time=1604131805, run_time=1.785, result_count=1015, alert_actions="", sid="scheduler__smadan__search__RMD5ab6a869ca92dbacc_at_1604131800_63960_638683B3-25D9-4D2A-AF2E-4E43362FDBFA", suppressed=0, thread_id="AlertNotifierWorker-0", workload_pool=""
... View more
11-01-2020
06:43 AM
We came to know that splunk custom alerts are not working after the upgradation to 8.0.1v.also receiving searches delayed error on the cluster..can any one help with this ?
... View more
Labels
- Labels:
-
alert action
-
alert condition
-
email
10-31-2020
01:27 AM
Hi Chaps, Need some help to understand why the alert is not getting triggered. This alerts query, when executed over 7 days period gives nonzero counts of 6 i.e. greater than 5(Our condition is trigger alert when nonzero counts exceeds 5). I see that alert is not getting even though we have nonzero count is 6.When we checked scheduler log Email action is blank.i have pasted the screen shot for reference.Please help me in this regards. Below is the query sourcetype="*" LOG_MESSAGE="Retry*" "Collections.NCS" NOT LOG_MESSAGE="Retry #1 *" | timechart span=10m count | autoregress count p=1-5 | eval nonzero=if(count > 0, if(count_p1 > 0, if(count_p2 > 0, if(count_p3 > 0, if(count_p4 > 0, if(count_p5 > 0, 6, 5), 4), 3), 2), 1), 0) | fields _time, nonzero i see the nonzero counts which exceeds 5.in below screen shot search query when we ran for over7 days of period below is the scheduler log.i see alert_action is blank. 10-31-2020 08:10:07.566 +0000 INFO SavedSplunker - savedsearch_id="XXX;search; alert", search_type="", user="XXX", app="search", savedsearch_name="XXXX alert", priority=default, status=success, digest_mode=1, scheduled_time=1604131800, window_time=0, dispatch_time=1604131805, run_time=1.785, result_count=1015, alert_actions="", sid="scheduler__smadan__search__RMD5ab6a869ca92dbacc_at_1604131800_63960_638683B3-25D9-4D2A-AF2E-4E43362FDBFA", suppressed=0, thread_id="AlertNotifierWorker-0", workload_pool="" Please find the alert condition:
... View more
Labels
- Labels:
-
alert action
-
alert condition
-
cron
-
email
10-22-2020
03:55 AM
Adding python.version = python3 is not required as i think.Since i see that python 3 is already running. Is it correct? /splunk cmd python3 --version Python 3.7.4 Regards,Shivanand
... View more
09-17-2020
04:14 AM
Hello is this solution worked for you? regards,Shivanand
... View more
09-07-2020
11:27 PM
Thanks for your reply .. We are doing offline update. Which are the splunk configurations need to check for this upgrade? Regards,Shivanand
... View more
09-07-2020
03:29 AM
We are planning to upgrade splunk OS RHEL 6 to OL 7.its single site cluster environment.i have few of doubts. What would be up-gradtion sequence? do we need to consider upgrade all vms in one mantainance window? is it ok if we upgrade indexers first and leave it for a week to see the performance and then we upgrade the search heads?is that ok to run with two different os in the splunk cluster. Any help would be appreciated. Regards,Shivanand
... View more
Labels
09-01-2020
01:07 AM
Ok.. Better to leave as it is.. But any suggestion to maintain the retention for other index we have..They are also helding more number of data.
... View more
09-01-2020
12:36 AM
Thanks for the reply. I see only jan month events for one of the index and there is no events are present till july.. I understand events are stored in the bucket and they will deleted once the buckets are rolled out.This is something strange i see.. how i need to get rid of this?
... View more
08-31-2020
11:47 PM
Hello Sir, this issue has started after the up gradation to 8.0.1.Prior to that there was no issues.is there anything i need to check
... View more
08-31-2020
11:43 PM
Hi Splunkers, We defined 35 days retention for real time indexes in splunk.I see that retention are not happening strictly.Some of the old events are not getting deleted .We have around 200 days data for some indexes .Also i see that for some indexes only January month data is present.I also cross checked with events time and indexed time. they are old data and not deleted due to retention policy.Now i have two concerns 1)How to maintain strict 35 days retention's ? 2)Any idea why January month data is present and it is not getting deleted even though buckets are rolling out? and how they can be deleted with retention's. Below are my settings for one index. [rt] # 80 GB a day / 14 days in warm / 35 day retention homePath = volume:hot/rt/db coldPath = volume:cold/rt/colddb thawedPath = $SPLUNK_DB/rt/thaweddb homePath.maxDataSizeMB = 500000 coldPath.maxDataSizeMB = 1000000 maxWarmDBCount = 300 frozenTimePeriodInSecs = 3024000 maxDataSize = auto_high_volume maxTotalDataSizeMB = 150000 Regards,Shivanand
... View more
Labels
- Labels:
-
indexer clustering
08-26-2020
11:02 PM
I still have this issue. I. have the same concern.These errors are appears from cluster captain.
... View more
08-11-2020
01:21 AM
Ok. Thanks .. Let me try
... View more
08-11-2020
12:54 AM
i am not using that .So i need to use that stanza for all the custom index.
... View more
08-11-2020
12:39 AM
Thanks for the reply. Custom indexes are created by me on indexer master node. i am speaking in master node.I am not able to see the custom indexes under settings -->indexer clustering---->indexes.... created custom indexes under below path /opt/splunk/etc/master-apps/ee_all_indexes/local
... View more
08-11-2020
12:21 AM
Hello Friends, I am not able to see custom indexes in splunk cluster master.can you please help me? Regards,Shivanand
... View more
Labels
- Labels:
-
indexer clustering
08-06-2020
07:15 AM
My host is not capable of resolving the ip address so can any one help to configure my ip address as mail relay.
... View more
- Tags:
- ipaddress
Labels
- Labels:
-
Linux
07-15-2020
04:15 AM
Old dated report is not ran due to the maintenance activity. can some one help how it be executed for 12th date and added to the summary index.
... View more
- Tags:
- summary index
07-06-2020
02:51 AM
I see the below error message on my search head cluster can some one help me to fix this. The percentage of high priority searches delayed (11%) over the last 24 hours is very high and exceeded the red thresholds (10%) on this Splunk instance. Total Searches that were part of this percentage=8313. Total delayed Searches=915
... View more
Labels
07-06-2020
02:44 AM
can you please tell me which attribute consider in limits.com.we have same issue.
... View more
06-19-2020
02:44 AM
We had connectivity hick up between the vms.So Vms rebooted .issue have been resolved Thanks
... View more
06-19-2020
02:21 AM
Hi all, We have 3 search heads are in cluster. serach head 1 is captain.Recently we upgraded to 7.2.3 to 8.0.3.after the upgrade i see that my search captain is in red and it showing search delayed error.none of the users are complained for any thing.But not sure why we see search head captain is in red and saying searches delayed.I am sure something is wrong , can some one please help with this. We tried restarting the and resync option.
... View more
06-19-2020
02:11 AM
Even we have same issue.Can you please tell which attributes value should increase.?
... View more
06-18-2020
05:39 AM
Ping is success.I am not seeing any connectivity issue.
... View more
- « Previous
-
- 1
- 2
- Next »
