No matter how many times disabled=0, after restarting Splunk, it automatically goes back to disabled=1. Can you please advise how to fix this ? ... View more

You can run from the Monitoring Console (splunk_monitoring_console app context)  to check THP effective state: | rest /services/server/sysinfo splunk_server_group=dmc_group_indexer | table splunk_server version numberOfCores, numberOfVirtualCores physicalMemoryMB ulimits.open_files transparent_hugepages.effective_state | sort +splunk_server ... View more

Hi @seunomosowon . I see in Splunkbase that this app was updated to v1.2.0 on 12/28/2020. I'm not seeing any indication in the Details page that this "buffer full" issue was addressed. Any chance there's a fix for this on the way?   ... View more

Hi @ravinder1k ,   I've just updated the app on Splunk base with a version that supports Splunk v8. Let me know if it works for you as I haven't tested it on Windows, but I tested it on Splunk 8.1 and 8.0.     Cheers,Seun ... View more

Hi xmertens If none of the answers here worked for you, please post this as a new question. Since this question was posted ~2 months ago, you won't get as much exposure and better help in answering your problem. Thanks ... View more

Understood. It does make sense to know which forwarder ran. Thanks for your help! ... View more

Hi Jibanes, were you trying to connect to port 110/ 143? I've just updated it and fixed a few issues along the way. ... View more

Hi Tom, I was just looking at tuned as well, but do share if you find some optimal values for this. I'd recommend looking at the the sap-hana as a base, and adjusting any other configs you might find that makes a difference. "tuned-profiles-sap-hana" takes some of its settings from the enterprise storage profile with the addition of some settings to disable THP. Swappiness could definitely go lower as recommended in the comments - 10. You should also turn off THP defray, as i've noticed a warning in mongod logs even if THP is turned off. Also, look out for network errors, packets being pruned, which may signify that you also have to tune the network settings and increase the buffer a bit. It'll definitely help if there was a profile for indexers, and another for search heads or other Splunk components. Seun ... View more

I reverted my SA-ldap to the v1 and it works fine with SHC. ... View more

Might be worth working including Splunk as a monitoring solution on the Vblock. Easy to precompute an expected range of events per second for each VBlock Model, and provide the customer with the option to have a monitoring solution prebuilt with the system. And of course, It would allow for some proper out of band monitoring of Syslogs from ESX, ASRs, Routers, UCS and all other networking devices. ... View more