Hi @DataOrg , I used some tables from the Architect Training course, but, as I said, it depends on the number of scheduled searches, from the number of concurrent users and from the presence of Premium apps. Ciao. Giuseppe ... View more

In clustered Splunk folder names in thaweddb folder should match db_<newest_time><oldest_time>_<bucketid>_<guid> naming convention. Also you can restore data from another indexer, just change the GUID to local (find in etc/instance.cfg). Please note that rb_ prefix should also be renamed to db_ ... View more

Just a footnote, mine replicated and looked like they should be working until  I realized I spelled the filename indexs.conf  instead of indexes.conf ... View more

For that communication you only need to be sure to open that port for both INPUT and OUTPUT, on both the DB node and your dbconnect node. ... View more

Awesome thanks ... View more

i am not aware of any script i got the file name on the add-on what needs to be turned on. ... View more

This has been solved many times including: Meta Woot!: https://splunkbase.splunk.com/app/2949/ TrackMe: https://splunkbase.splunk.com/app/4621/, Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/ Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/ Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/ Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarder_warnings ... View more

yes its works thanks its because of two pipes i tried with a single pipe and got worked. ... View more

added the indexer address to the host file of the sh , Because the dns name is not able to resolved. ... View more

thanks for your answer , i removed all the old logs from the main directory and restarted the forwarder and the logs came up. ... View more

Thanks Azeem , It worked and my logs looks good now. ... View more

Where are your stanza is written? is it indexer or heavy forwarder or universal forwarder? ... View more

Awesome Thank you so much for detailed explanation really appreciate your time. ... View more

Thank you so much ... View more

so do i need to add crcSalt= or just crcSalt => ... View more

Thank you so much will solve my issue ... View more

i check the internal logs of that host and seeing no events ... View more

It could be due to various reasons. You can try debugging it in few ways 1. Does the HF have UI enabled? if yes, try using your query to see if the results are being returned at all via the DBconnect UI 2. Check the DBconnect logs coming from HF. Does it give any clue? (or paste the logs here) 3. Check for errors in splunkd.log & dbconnect logs from HF to see if there is any errors , especially related to credentials or driver path 4. Create a dummy connection to the relevant SQL client and ensure if that's coming for example if the client is Oracle, do a dummy query (and put create a connection) and see if that value is getting to the Indexers select to_char(sysdate,'DD-MON-YYYY HH:MI:SS AM') from dual ... View more

Ok got it my inputs are on heavy forwarders whereas my outputs are on search head now if i move my outputs of db connect from search head to HF i am not getting any data your answer satisifies me to have outputs of db connector on search head so it will read data from indexers , dis i understand correct ? ... View more