This is how I tried in my environment. Created power user, logged in with that user. Created lookup tables and provided read to all and write permission to admin. Logged in as admin user now, >> lookup tables >> under permission >> I can find "All apps" tab as well. You cam try same steps. ... View more

It depends on your amount of data ingestion. If data ingestion is high, then warm buckets will be filling soon to 50, which rolls to cold. ... View more

For monitoring the resource usage on Splunk universal forwarder, you need to enable an add-on like below. The introspection generator add-on is disabled by default on a universal forwarder. To enable: in the forwarder's $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf, set [install] state = enabled To monitor UF resource usage in Monitoring console, please follow below doc: https://docs.splunk.com/Documentation/Splunk/7.2.6/DMC/Configureforwardermonitoring ... View more

Not very clear on the question, however in authorize.conf we have few parameter to restrict the index from viewing for specific roles. You can actually refer below doc for more information. https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Addandeditroleswithauthorizeconf#Search_filter_format and also, you can refer below splunk answer for reference. https://answers.splunk.com/answers/672165/how-to-build-a-srchfilter-when-two-indexes-are-all.html ... View more

But in today's license usage when i opened in search it is using rest command hitting the rest point of the slaves. So i opened same rest API via 8089 port and found the same information. Based on the SPL i just understood this way. ... View more

The license slaves are connected to the license master via management port. License master every minute will hit the license slaves rest point at 8089 port which discloses information about license slave. If you see today's usage to open in search you will be able to find the rest command and what information is collected from slave. Also, you can try hitting the rest API directly to know what information is disclosed from slave to master. ... View more

As a part of splunk I would recommend to have splunk supported add-on installed, https://splunkbase.splunk.com/app/2729/ There are relevant documents to support this add-on, this add-on is tested on all splunk versions and you can find the compatibility on the splunkbase . You can refer below splunk docs to install and configure the inputs. https://docs.splunk.com/Documentation/AddOns/released/MSSCOM/Install https://docs.splunk.com/Documentation/AddOns/released/MSSCOM/Configureinputs ... View more

If splunk stops, check for crash logs at splunk_home/var/log/splunk/crash.log* to verify if splunk is crashing due to internal issues with splunk. If you don't find the crash logs you need to check system logs to check if kernel killed the splunkd service due to out of memory/booting of file system and so on. If the kernel killed the splunkd service due to memory, then you need to check if splunkd as a whole is consuming memory or any particular search is using whole memory. However, you need make sure whether you have memory for splunk to run, at least basic recommendation of splunk. This varies if you have more apps to run/more inputs. ... View more

if you want to stop the monitoring from the source >> On forwarder >> check for the monitoring stanza you have set under "inputs.conf" and disable it by giving disabled = 1 for that particular input alone, so that it will stop monitoring the inputs. ... View more

Cooked connection denotes communications between two Splunk nodes as opposed to Raw connections which refer to non-Splunk nodes passing their data to Splunk. First we need to ensure that the forwarder is listening on the correct port. To determine this we simply issue a netstat: netstat –an | grep 9997 If the forwarder is listening properly you should see a result similar to: Tcp 0 0 0.0.0.0:9997 0.0.0.0:* LIST This tells us that the forwarder is in listen mode for port 9998. Now that we’ve determined we’re listening on the correct port we need to test the communications path between the forwarder and indexer. To do this we attempt to open a telnet session to the indexer from the forwarder: telnet indexername.domainname.com 9997 If the port is available the connection should be successful almost immediately. Should the connection fail we’ll want to try another port to determine if we have a port availability issue or something more. So next we’ll attempt to telnet to port 8089 (Splunk management port which should always be open on an indexer): telnet indexername.domainname.com 8089 If the connection is successful you should see something close to the following: Connected to indexername.domainname.com Once we’ve made the successful connection, we now know that there is an open port issue with port 9998 to the indexer. Now the question remains, is this an issue at the firewall layer or within a local firewall such as iptables on the indexer itself. To determine this, we SSH into the indexer and attempt to telnet back onto ourselves via port 9998. telnet localhost 9997 If the problem lies with a local firewall such as iptables, you will receive an error similar to the following: telnet: connect to address ::1: Connection refused So what does this tell us? The refusal locally tells us that port 9998 has not been opened via the local firewall and this is the source of our issue. To resolve we simply open port 9998 via iptables (or your local firewall) to resolve. iptables –D INPUT –p tcp –dport 9997 –j DROP service iptables save If the telnet connection to localhost connects successfully, you have determined that the communications issue is tied to the fact that port 9998 needs to be opened at the network firewall layer to allow communications with the forwarder. ... View more

One thing i observed in indexes.conf is " repFactor = autor " which is invalid. Can you change to "repFactor = auto" and try to push bundles again to peers. http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Configurethepeerindexes#1._Edit_indexes.conf ... View more