About a109120

greich · ‎11-28-2018

I have the same issue. What I found out so far is that on some very large events, the eventtype is correctly identified by the indexers and returned to the search heads, but if the marker (search string, term) appears to "deep" into the event, it is not matched on the search head, and of course neither is any tag associated with it. Typically on stacktraces where the event is 2-400 lines or more. Likely some limit on search heads with respect to pattern matching. Will update if I dig something up.

a109120 · ‎08-16-2018

We just recently upgraded some of our equipment and decided to move the old equipment into our dev environment to set it up as a separate cluster. What is the best way to route production data over to the dev environment? I am looking for the best option that isn't too demanding on the production environment and won't eat up our license. We were considering looking into setting up Splunk HEC as a possibility. I am just brainstorming ideas currently I am open to all suggestions! Thanks!

a109120 · ‎08-09-2018

I gave this a try and the timechart did not assign any values to the this_week/last_week columns. I think I have a few ideas to get that to work. Thanks for the input

Posts	5
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎08-07-2018

Online Status	Offline
Date Last Visited	‎09-02-2020 02:14 PM

Why is eventtype not tagging 100% of events?

How to send production events into dev cluster?

How to build a summary index that uses eval statem...

Re: Why is eventtype not tagging 100% of events?

How to send production events into dev cluster?

Re: How to build a summary index that uses eval st...