About some_guy

kairobin · ‎06-08-2022

Hi, Did you find a fix for this issue?

some_guy · ‎04-07-2020

lacastillo · ‎06-14-2018

You're very welcome!

Lucas_K · ‎05-12-2015

I think its actually required and there isn't any configuration that I can see to relocate it. Also "huge" is relative to the volume of data that db connect is shuffling around. How big was huge?

aaronkorn · ‎03-17-2015

I would modify your syslog-ng.conf to rotate the files every hour with something like this destination d_cisco_switches { file("/opt/syslog-data/cisco_switches/$HOST/$YEAR-$MONTH-$DAY/$HOUR-cisco-switches.log" create_dirs(yes)); }; . Depending on how chatty your source is you can also use logrotate but a good rule of thumb is to keep it below 1GB per file. Also, what is the use case for the HF between the UF and IDX's? You can get away with just UF -> IDX.

hrithiktej · ‎09-26-2017

oh ok, thanks from next time I will create a new post, Did you mean to say that forwarding should be enabled on the license master to record license usage. Because if I take out indexers IP from the outputs.conf of License master than the license usage is not counted. So now I see 1 H.F. i.e. our license master in our environment when I see forwarder deployment under DMC

some_guy · ‎02-13-2015

Ok, got it. Thanks for the suggestions, which did set me on the right path... copied the logo image to: $SPLUNKHOME$/etc/apps/search/static then referenced it in the html file: <img src="{{SPLUNKWEB_URL_PREFIX}}/static/app/search/logo.PNG" alt="logo"></img>

AndySplunks · ‎12-22-2015

It appears this article may help you. The section labeled "Suppress notable events from new correlation searches" appears to have the answer to your question. http://docs.splunk.com/Documentation/ES/2.4/Install/NotableEventSuppression

Posts	14
Solutions	0
Karma Given	6
Karma Received	5
Member Since	‎03-19-2014

Online Status	Offline
Date Last Visited	‎06-21-2022 02:25 PM

show unconfigured forwarders from deployment serve...

Using regex, how to exclude any events in the host...

rsCache.data really huge file ( dbx v 2)

What are recommendations for our current file moni...

How will removing a heavy forwarder from my curren...

embed a graphic on a dashboard, splunk 6.2

Clustered indexes not showing up in the index list...

Splunk ES Incident Review Suppression

Re: Clustered indexes not showing up in the index ...

Re: show unconfigured forwarders from deployment s...

Re: Using regex, how to exclude any events in the ...

Re: rsCache.data really huge file ( dbx v 2)

Re: What are recommendations for our current file ...

Re: How will removing a heavy forwarder from my cu...

Re: embed a graphic on a dashboard, splunk 6.2

Re: Splunk ES Incident Review Suppression

Are you a member of the Splunk Community?