About Abilan1

Abilan1 · ‎02-25-2016

Hi , I have updated the settings as like below and restarted splunk, but it didn't clean up my old data from the indexer. Please find my indexes.conf below [test] coldpath = $SPLUNKDB/test/colddb homepath = $SPLUNKDB/test/db thawedpath = $SPLUNKDB/test/thaweddb maxTotalDataSizeMB = 500000 frozenTimePeriodInSecs = 31556926 Please let me know if you still want to make any changes in the index details.

Abilan1 · ‎02-12-2016

Thank you!

Abilan1 · ‎02-12-2016

Hi , Can someone please help me here?

Abilan1 · ‎02-11-2016

Thank You so much! 1. In case If I want to clean up all the 1 year old Data from my "TEST" index, how can I do that? 2. Also please confirm me we need to modify which size (Max size (MB) of entire index or Max size (MB) of hot/warm/cold bucket)? Also If we modified this size, will it automatically purge the old data in future whenever this index touches it's maximum size. do we need to restart after this modification?

Abilan1 · ‎02-11-2016

Hi , We are about to reach the maximum size of the disk on our Indexer server. Please suggest if there is any way to purge data that is 90 days old from Splunk Web, or is there any setting to overwrite the old files from Splunk Web?

Abilan1 · ‎02-10-2016

Thanks again. I will check and update you from my side.

Abilan1 · ‎02-10-2016

Hi, Thank you so much!.. We have already splunk Web enabled on our indexer, If we want to act that as a search head also (to configure alerts and Dashboards), then If we enable search head option from this setting on that Indexer (Distribute Management console>Setup>Edit Server Roles> Enable Search Head) will it be enough? or do we need to perform any other steps?

Abilan1 · ‎02-10-2016

Hi , We are planning to have only one machine for Splunk (Indexer and search head in the same). Is it possible? can we make it to act index server also as a search head? Thank You!

Abilan1 · ‎02-09-2016

Hi, I would like to move my alerts and dashboards to another server. Actually we have a separate search head and Indexer now. We are planning to drop our search head and move all the alerts and dashboards to that indexer server. Is it possible? (what are all the folders that need to be copied if we are migrating from one to another?). If it is not possible, should we have a Search Head for setting up alerts and Dashboards? Is it possible to make that indexer act as a search head as well? Please suggest. Thank You!

Abilan1 · ‎12-07-2015

Thank You!

Abilan1 · ‎12-07-2015

Hi , I have a Splunk indexer server and search head already and am planning to install Oracle WebLogic App for Splunk in my setup. I have the license for 10 GB and only using Search & Reporting for now. Please let me know, do we need to purchase any license for WebLogic App? And please help me to get documents to implementing this app? Thank You!

Abilan1 · ‎11-27-2015

Hi , Actually I am having splunk index servers in Eastern Time Zone (UTC-5:00) but some of my application servers are in Hong Kong Time Zone (UTC+ 08:00). so now if I see the data in splunk it's all are in Eastern Time zone. I wanted to change the time stamp to Hong Kong Time zone only for these servers.

Abilan1 · ‎11-12-2015

Hi , Please try the below one, index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host

Abilan1 · ‎11-11-2015

hey, it is working... Thanks!!

Abilan1 · ‎11-11-2015

Hi , I would like to set up alert for only one specific index..this query shows all the index. Please let me know how can i get it only for that specific index? Thanks

Abilan1 · ‎11-02-2015

hi, Thank You! It is capturing only 1st record from that indexed line..As I said earlier, am having more records in the same line.. STD QBATCH:P ALIUYFG 54902 R5641003_A0000002_5853971 STD QBATCH:P JUCHOI 158875 R5641003_A0000002_5870061 STD QBATCH:P GYLUT 23335 R5609811_A0000003_5871713

Abilan1 · ‎11-02-2015

hi I am getting "Regex: unmatched parentheses" error..

Abilan1 · ‎11-02-2015

This one R5609811_A0000003

Abilan1 · ‎11-02-2015

Please find below STD QBATCH:P ALIUYFG 54902 R5641003_A0000002_5853971 STD QBATCH:P JUCHOI 158875 R5641003_A0000002_5870061 STD QBATCH:P GYLUT 23335 R5609811_A0000003_5871713

Abilan1 · ‎11-02-2015

hi, Thanks for your reply! whitespaces will vary.it's not constant.

Abilan1 · ‎11-02-2015

Hi, Sample log file: STD QBATCH:P GRAUT 77718 R5609812_S0000001_5847829 I want to create that highlighted term as a new event field. Only STD in that above line will be common in all over the logs, remaining words or characters may change. So I am not sure how to use Rex here. Also in the same indexed line it may occurs many time. Thanks!

Abilan1 · ‎11-02-2015

Hi, I have checked the file type, it is UTF-8 encoding. Splunk is indexing only 1st line of that file. Thanks!

Abilan1 · ‎10-29-2015

Hi , I have saved the outlook file as a text fie and placed that file into a Splunk monitoring folder. Splunk is just indexing only the 1st line of that text file and for some other converted text files, it is not even indexing a single line. I would like to know if Splunk supports these kind of files or any other way to do this? Thanks!

Abilan1 · ‎10-05-2015

Hi , We are not using office 365. still can we use IMAP? Thank You!

Abilan1 · ‎10-05-2015

Hi, Is it possible to send data inputs to Splunk via email? We are getting an email from other teams with some important data, and we would like to upload those details as well in Splunk so that we can make a dashboard with that.. Thank You!

Posts	144
Solutions	0
Karma Given	19
Karma Received	5
Member Since	‎05-08-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk Universal Forwarder monitoring

Splunk Time stamp modification

Splunk is not indexing my text file

Is it possible to upgrade only one of our indexers...

Why is old data not being deleted every day after ...

How to troubleshoot why a scheduled alert suddenly...

Is there any way to have the below query without m...

Dashboard creation not working as expected

How to fetch the before event of the search field

Bucket details check

Re: Is there a way to delete data on an indexer fr...

Re: Is there a way to delete data on an indexer fr...

Re: Is there a way to delete data on an indexer fr...

Re: Is there a way to delete data on an indexer fr...

Is there a way to delete data on an indexer from S...

Re: How do I migrate alerts and dashboards from a ...

Re: How do I migrate alerts and dashboards from a ...

Re: How do I migrate alerts and dashboards from a ...

How do I migrate alerts and dashboards from a sear...

Re: Do we need to purchase any license for the Ora...

Do we need to purchase any license for the Oracle ...

how to change the upload time stamp?

Re: How do I find which host is using the most dat...

Re: How to setup an alert if any index size goes o...

Re: How to setup an alert if any index size goes o...

Re: How to use Rex command to extract this field f...

Re: How to use Rex command to extract this field f...

Re: How to use Rex command to extract this field f...

Re: How to use Rex command to extract this field f...

Re: How to use Rex command to extract this field f...

How to use Rex command to extract this field from ...

Re: Why is Splunk unable to index a converted text...

Why is Splunk unable to index a converted text fil...

Re: Is it possible to send data inputs to Splunk v...

Is it possible to send data inputs to Splunk via e...