We had a situation where we lost data for last quarter for one specific Index. We have 4tb HDD space on the indexers and 1.9 is being used. Later with the help of a support engineer, we realized that that index was allocated 500gb of Space and hence the data was deleted. (for the time being we have increased the value to 700gb for maxTotalDataSizeMB.) As we do not have an archive path setup, we will not be able to restore the data. In our internal testing, we restored the buckets from frozen db to thawdb in a new index and used the rebuild command. We were able to get data back from 2010 to 2014 from the frozen db. So my question is, if we have data from 2010 to 2014, how do I find the data for the last quarter? the data is missing only from march 10th to june 12th ... View more

index="np_dpa" PROXYNAME="ProcessUBIDeviceFulfillmentCommunication" Application="Datapower" TransactionStatus="FAIL" TransactionDesc="VOUCHER_INVALID" | table PolicyNumber,DeviceFulfillResp, DeviceFulfillErrorVins, CorrelationId, _time | fields - _raw | sort _time I have this serach which displays the policy number details and its related fields. This is for all the failed transactions (TransactionStatus="FAIL"). As soon as the policy is reprocessed, its transaction status will change to success. I want the panel to exclude those policy numbers where the transaction status is changed. Using | stats latest(TransactionStatus) by CorrelationId does not display data ... ... View more

I do not see an option for http event collector in Splunk Web. We have a search head cluster and an indexer cluster. Should I create an app on the deployer and push the configuration to all search heads? Also, another question is the token which needs to be generated. Does it have to be in any specific format or can any random token can work? Thanks a ton. ... View more

Hi I have a similar issue. I do not see HTTP Event Collector, under data inputs. /opt/splunk/etc/apps/splunk_httpinput/default inputs.conf $ more inputs.conf [http] disabled=1 port=8088 enableSSL=1 dedicatedIoThreads=2 maxThreads = 0 maxSockets = 0 useDeploymentServer=0 I have the same version in non prod but the only difference is, prod is a search head cluster and non prod has only one search head. It is available in non prod, the file contents of inputs.conf are the same. What needs to be modified in inputs.conf? ... View more

got a date extracted from a file name and got the count of files received on for that extracted date. date-2016-03-28 extracted from the files received at a specific location. /ubidata/axway/JourneyData/AAA_NA_70_2016-03-28-00-47-08_353466071286872_1HGCR2F5XDA159398_0_0.zip Now we want a time chart to show the count of extracted date(2016-03-28) on that date. The default timechart shows values by system time. Want to use the extracted date as the xaxis date and showing the timechart trend for those counts. Thanks. ... View more

We have installed the nmon app but it shows mem usage as 98% for all the indexers When I do run a top command I do not see that much memory being used. How do verify whats causing the issue, is the Nmon app showing the right data or is it really an issue on splunk indexers. ... View more

Hi we are using fs_notification and monitoring a specific path. I have a field called path which has the following values. Now I have to extract the date from the name of the file which is 2016-03-28 for the following files and then do a count of those values. /ubidata/axway/JourneyData/AAA_NA_70_2016-03-28-03-30-07_353466071554972_NA_0_0.zip /ubidata/axway/JourneyData/AAA_NA_70_2016-03-28-00-47-08_353466071286872_1HGCR2F5XDA159398_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-23-38-13_353466070336173_5J6YH28776L027013_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-23-11-04_353466070738055_JHMES96664S000240_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-22-23-29_353466070290842_1FTRW12557FB57292_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-36-26_354235059078372_1GNDV23LX6D194324_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-31-06_354235059637177_JTDBR32E170131585_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-27-01_354235059626014_2GKFLSE39D6131090_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-14-59_354235059651772_3FAHP06Z48R221560_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-20-08-00_354235057942819_1G1ZT64885F132289_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-19-50-45_354235058343207_JHLRM3H51CC010877_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-19-20-32_353466070121963_1J4FT28B19D178678_0_0.zip /ubidata/axway/JourneyData/AAA_NA_709_2016-03-28-18-23-14_354235059577712_5FNYF28407B037209_0_0.zip ... View more

I need to find out the level of permission (user/power/admin) for the roles/groups on all apps. any leads on that would be helpful. Thanks. ... View more

We are using this search for a Splunk license usage dashboard. it works fine in Splunk 6.1, but when we run this from a 6.3 search head, it gives twice the values. We switched off the load balancer pointing to the the old search head now have invalid data. index=_internal source=*license_usage.log* type=Usage | timechart span=1d sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB Thanks, Anil. ... View more

Is there a way to restrict this search with upper case and lower case scenarios? index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR "@end***]Action updated in DB!") When I use this @end*** , it also returns results with END_IMPORT*** , which is an event detail for failed jobs. Two different search scenarios ... View more