In general every thing is come to your user count,Max concurrence searches running, how many reports, how much data load all will come into picture. As general recommendation is below one Master distributed the data. 4xquad-core CPUsat2.0 GHz/12Gb ~ 16GB RAM/ 2x10kRPMlocal SAS drives in RAID 1 To test your load please make sure your run Bonee++ utility on linux servers. ... View more

first check from your network and firewall team to make sure splunk ports and firewall rules are enabled for splunk. some times this error messages point to SSL enable also on the indexer. Don't forget to add the SSL stanza in the inputs.conf on the indexer side. ... View more

couple of things you can try, after seeing that message it sounds like parsing Que issue. you can try increase maxQueueSize = 200MB in outputs.conf. some times the maxQueueSize setting causes events to be loaded into a queue in memory so Before increase check your memory and performance using top what ever OS command. Note: check out metrics.log and parsingQueue or TCPque is full etc errors ... View more

Thanks sounds like some direction to work. but i never worked on tokens, do we have any splunk app see here is my headers for those sheets. Arrival city Country Email First name From date Last name Mobile To date ... View more

Few things can you verify it from UF to Indexer server. Check the port connections as well firewall rules most of the time TCP error/Cooked data refer to these kind of issues. Telnet to port and IP. etc Try to troubleshoot problem from Network layer to Splunk you will find it. ... View more

Its depend on your server hardware model and type, Its all depend on how much memory you have on server how many users are running searches etc.Lets you have 8 core 24GRam right for 40 users one search head is enough. max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches To fix the problem more generally, you can tweak some configuration nobs in limits.conf as follows: a) max_searches_per_cpu While increasing this could fix the dashboard issue where searches are fairly cheap to run, this could lead to performance degradation if you've scheduled a large number of expensive searches. b) dispatch_quota_retry This is the number of retries the back end will attempt before throwing the quota/limit error. The back end here does an exponential back-off starting with 100ms and doubling that every time it retries. c) dispatch_quota_sleep_ms The initial sleep time for retries. Instead of increasing max_searches_per_cpu you can set the dispatch_quota_retry to 10 which will instruct the back-end to retry dispatching a particular search for about 100 seconds before throwing the quota/limit error. ... View more

Thanks for your help i have checked that already. im running with spluk 6.1 verison ... View more

This is not working for me |metadata type=hosts | table host lastTime | where lastTimerelative_time(now(),"-30d@d") | convert timeformat="%Y%m%d" ctime(lastTime) AS LastTime ... View more

check this url, i had similar issues then i found version mismatch on SH peers. http://answers.splunk.com/answers/192592/search-process-did-not-exit-cleanly-exit-code255-d.html#answer-195456 ... View more