About phoffman_splunk

AnonSplunkUser · ‎04-01-2025

Excellent information and writeup, thank you for the verbose explanation!

knulps · ‎04-13-2021

Thanks for this solution. it worked for me. I went ahead and made my Monitoring Console as standalone. that fixed the issue.

ddrillic · ‎01-24-2017

When I run the following - index=_internal host=x1209 group=queue blocked name=indexqueue | timechart count by queue I don't see the results matching the - index=_internal host=x1209 group=queue unblocked name=indexqueue | timechart count by queue Meaning, blocked versus unblocked. My problem is that only by bouncing Splunk, the 9997 port becomes open and it starts indexing. According to the License Usage - Previous 30 Days , this indexer hasn't indexed any data for three days until the bounce.

phoffman_splunk · ‎09-28-2015

You should always allow Splunk to perform it's rolling restart process. But in the rare cases where it is necessary to control the restart process; you can run the following command (in it's entirety) splunk apply shcluster-bundle -action stage && splunk apply shcluster-bundle -action send This will bundle up the configs and push to the SHC peers; with no restart forced Then you can later run splunk rolling-restart shcluster-members from the captain to perform the restart of all peers. reference link:Control the restart process

alekksi · ‎10-28-2016

No, it's a suggestion to update to the latest version, which is also the resolution to this issue.

fbotte · ‎04-30-2017

had the same issue with splunk 6.5.3 in my case the problem was the firefox extension priv3+

phoffman_splunk · ‎02-20-2015

This topic is covered in the docs here: Set limits on disk usage

tim_snider · ‎12-20-2013

That's fine -- thanks for the response -- I wanted to make sure I wasn't missing something obvious. Tim

phoffman_splunk · ‎12-11-2013

The documentation; will answer your question: http://docs.splunk.com/Documentation/Splunk/5.0.6/Installation/HowtoupgradeSplunk when upgrading to 5.0.x, going from 4.2.x is a supported path. Going to 6.x you have to be on 4.3+. There is also a list of things to consider and warnings on back ups before you update. The subtopics will answer questions around upgrade order for distributed environments and/or the order of forwarder upgrades in relation to your servers.

Akili · ‎12-24-2013

had the same problem, couldnt connect to indexer in windows for universal forwarder installation ( 5.0.4) please check the files in: path /SplunkUniversalForwarder/etc/system/local replace the config files under with those from: path /SplunkUniversalForwarder/ etc/ apps/Windows /local restart splunkforwarder: splunk restart it should get connected in splunk host i can see the forwarder has been connected and it has send logs. i had activated some advanced audit features.

aholzer · ‎06-27-2013

I don't believe it's a change in a splunk .conf file. When you run the CLI that several people mentioned below, it will make an entry into /etc/init.d I believe. That's where you'd have to check, but you can't roll something out via the deployment server to that location. You may want to write a script that takes a list of hosts and runs the CLI on each host.

omatsei · ‎05-07-2013

Maybe I'm not explaining it right. The data is coming in tagged as "domaincontroller.domain", but I want it to be tagged as "domaincontroller". All the other data from the same domain controller, using the universal forwarder, is tagged as "domaincontroller". Why are the fields for the security stuff tagged differently?

phoffman_splunk · ‎03-26-2013

Only the Support team can look into that and fix for you. You will have to put in a ticket to Splunk support for that issue.

Posts	30
Solutions	8
Karma Given	164
Karma Received	30
Member Since	‎11-28-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Search Head Clustering: How to push config bundles...

Re: knowledge bundle

Re: Search head returning no results from peer

Re: Why some of our indexers stop listening on por...

Re: Search Head Clustering: How to push config bun...

Re: I upgraded to Splunk 6.2.2 and now get errors ...

Re: Why am I getting a server error on login page ...

Re: How can I resolve this problem : The minimum ...

Re: bonnie++ -- anything Splunk Specific?

Re: Upgrading to Splunk 5.0.6 from 4.2.3

Re: TcpOutputProc Connection to ...... closed. Con...

Re: configuring splunk to start at boot time confi...

Re: Active Directory User Logon Failures

Re: Not able to view my support cases

Join the Conversation