Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Rob2520
Rob2520
Communicator
Member since:
06-28-2018
3 weeks ago
Community Statistics
| Posts | 63 |
| Solutions | 5 |
| Karma Given | 5 |
| Karma Received | 9 |
| Member Since | 06-28-2018 |
Activity Feed
- Posted Is it possible to move Splunk Security Essentials Bookmark to Enterprise Security Search Head? on Splunk Enterprise Security. a month ago
- Karma Re: Column Chart / How to change color of particular column for nadlurinadluri. 07-01-2022 12:47 PM
- Got Karma for Re: How do you change the ownership of saved reports in 6.5.2?. 03-21-2022 11:52 PM
- Got Karma for Re: How do you change the ownership of saved reports in 6.5.2?. 06-29-2021 07:13 AM
- Karma Re: New "role" cannot be added to any users due to "is not grantable"; how to make roles "grantable"? for woodcock. 11-19-2020 09:03 AM
- Got Karma for Re: Cannot connect to SQL database. 06-05-2020 12:50 AM
- Got Karma for Re: Cannot connect to SQL database. 06-05-2020 12:50 AM
- Got Karma for Re: how do I get live updates into a Splunk dashboard?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me extract the following data into separate fields?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you change the ownership of saved reports in 6.5.2?. 06-05-2020 12:50 AM
- Karma Re: bin and bucket command examples to practice for woodcock. 06-05-2020 12:49 AM
- Got Karma for Re: What is the best way to count events and calculate the disk space these events use?. 06-05-2020 12:49 AM
- Got Karma for Re: Why does the collect command does not work for search head/indexer cluster and I received the following error "event for unconfigured/disabled/deleted"?. 06-05-2020 12:49 AM
- Karma Re: How to add a new Active Directory group to an existing LDAP strategy? for nickhills. 06-05-2020 12:48 AM
- Karma Re: Time zone in TIME_FORMAT for peterzhoupeterz. 06-05-2020 12:45 AM
- Posted Re: Why am I getting "The view you requested could not be found" after clicking "View Results" in an alert email? on Alerting. 12-16-2019 11:32 AM
- Posted Re: Duplicate index stanza in indexes.conf in a clustered environment on Deployment Architecture. 12-03-2019 01:05 PM
- Posted Duplicate index stanza in indexes.conf in a clustered environment on Deployment Architecture. 12-02-2019 08:39 PM
- Tagged Duplicate index stanza in indexes.conf in a clustered environment on Deployment Architecture. 12-02-2019 08:39 PM
- Tagged Duplicate index stanza in indexes.conf in a clustered environment on Deployment Architecture. 12-02-2019 08:39 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
a month ago
Hi Splunkers,
We have a ton of bookmarked content in Splunk Security Essentials App on one of our Dev Splunk search heads. Now i want to move that to Enterprise Security Search Head. Is that possible?
... View more
Labels
12-03-2019
01:05 PM
Thanks @manjunathmeti. I will test it and accept your answer.
... View more
12-02-2019
08:39 PM
Hello Splunkers,
I have an indexes.conf file where i have a duplicate index stanza. If i remove one of them will it impact anything? Below is my duplicate stanza. I will probably remove top one if there's no impact.
[custom]
homePath = volume:hot/custom/db
coldPath = volume:cold/custom/colddb
thawedPath = $SPLUNK_HOT_DB/custom/thaweddb
maxDataSize = auto_high_volume
frozenTimePeriodInSecs=31557600
maxTotalDataSizeMB = 500000
homePath.maxDataSizeMB = 66800
repFactor = auto
[custom]
homePath = volume:hot/custom/db
coldPath = volume:cold/custom/colddb
thawedPath = $SPLUNK_HOT_DB/custom/thaweddb
maxDataSize = auto_high_volume
frozenTimePeriodInSecs=31557600
maxTotalDataSizeMB = 500000
homePath.maxDataSizeMB = 66800
enableTsidxReduction = true
timePeriodInSecBeforeTsidxReduction = 15552000
repFactor = auto
Thanks!
... View more
11-11-2019
06:30 AM
@gcusello Thanks for the post. Do we have to stop Splunk or put cluster master in maintenance mode or any other change during the migration from SAN to local disks?
... View more
04-24-2019
01:17 PM
Hi @Venkat_16. I am facing similar kind of issue and adding LOOKAHEAD setting didn't fix. In my case props and transforms are on heavy forwarder. Does these conf settings needs to go on Indexers as well?
... View more
02-20-2019
11:02 AM
Hi @jbrocks User which installed Splunk and owner of splunkd process are the same. I copied the whole error message. Unfortunately the error doesn't say which file it's trying to write to and failing. Is there any way we can find which file it is?
... View more
02-20-2019
07:52 AM
Seeing tons of these errors in splunkd logs of indexers. What could be the reason? We are also experiencing search performance issues. Not sure if it's aligned to the error message.
... View more
- Tags:
- splunk-enterprise
01-13-2019
04:43 PM
Check this accepted answer https://answers.splunk.com/answers/703136/minemeld-lookup-errors-after-upgrading-splunk-to-7.html
... View more
01-05-2019
09:13 AM
is this app working with splunk 7.x versions? Looks like it's only compatible till 6.6
... View more
11-30-2018
08:13 AM
@coreyf311 did you find any resolution to this issue? I started seeing same error popping up ON and OFF on my search heads.
... View more
11-29-2018
10:01 AM
@hortonew Do the update need to be done on just search head or both search head and indexer? I updated Maxmind Geolite2 on just my search head and restarted splunk. I'm asking this question even after seeing your blog because for one of the IP i see inaccurate results. Any suggestions is appreciated. Thanks!
... View more
11-13-2018
01:25 PM
splunkdConnectionTimeout = 1200 worked for me.
... View more
11-08-2018
09:25 AM
Try this query
index=_internal source=*license_usage.log type=Usage earliest=-30d@d latest=@d
| stats sum(b) AS Bytes by idx
| eval GB = round(Bytes/1024/1024/1024,2)
| rename idx as index
| table index GB
| sort -GB
For additional statistics on average and max license usage check my other post
https://answers.splunk.com/answers/694793/can-you-help-me-improve-this-alert-for-indexes-tha.html#answer-695677
cheers!
... View more
11-08-2018
08:44 AM
did you check the permissions on the file? This stanza [monitor://D:\eo\contLive\logs\*.log] should catch all files ending with .log. If you want job*.log with a different sourcetype try this inputs.conf
[monitor://D:\eo\contLive\logs\*.log]
sourcetype = progress:contlive
index = progress
disabled = false
blacklist = job[\d\w]+\.log$
[monitor://D:\eo\contLive\logs\job*.log]
sourcetype = progress:inter
index = progress
crcSalt = <SOURCE>
disabled = false
... View more
11-07-2018
12:59 PM
Can you share your whole JSON event?
... View more
11-05-2018
01:39 PM
https://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html
https://answers.splunk.com/answers/30585/route-syslog-data-to-specific-index-by-host.html
The above answers should help what you are looking for.
... View more
11-05-2018
11:20 AM
If you click on any of the apps do you see clients under it? Is there a serverclass associated with these apps? If Yes, try restarting your deploymentserver when possible and see(not a best practise to restart deploymentserver quite often during business hours unless there is a dev deploymentserver).
... View more
11-05-2018
09:25 AM
@anoopdi can you share your deploymentclient.conf ? Also, do you see anything under clients in forwarder management?
... View more
11-02-2018
05:51 PM
I personally never gave that capability to anyone. But you could try edit_deployment_client, edit_deployment_server, list_deployment_server capabilities.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma from
