How can i add a splunk server in Active Directory Domain. ... View more

I would like to see the list of all the Indexes along with the Earliest and Latest Time stamp for the most oldest log and most earliest log stored in that index. I used following qeuery but i take to much time to provide the resluts, is their any other method to see this information as quick as possible. index=* | stats first(_time) as latest last(_time) as earliest by index | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(earliest) ctime(latest) ... View more

Hi, What is the queury to identify conflicting buckets in an Index. ... View more

Hi have followed the following Splunk Restore archived data, but coudnot able to searched the restored data. Can any one please help me, is there any ohter way to restore archived data back into splunk. Restore archived data by moving the archive into the thawed directory, $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb. You can restore an archive to a Splunk server regardless of operating system with some restrictions -- data generated on 64bit systems is not likely to work well on 32 bit systems, and data cannot be moved from PowerPC or Sparc systems to x86 or x86-64 systems, and vice versa. Data in thaweddb is not subject to the server's index aging scheme (hot > warm> cold > frozen). You can put old archived data in thawed for as long as you need. When the data is no longer needed, simply delete it or move it out of thawed. The details of how to restore archived data depends on how it was archived. You can restore archived data to any index or instance of Splunk, with the caveat that you do not introduce bucket ID conflicts to your index. Archived data does not need to be restored to its pre-archival location. **nix users* Here is an example of safely moving a previously saved archive bucket to thawed. 1. Copy your archive bucket to the thawed directory. # cp -r db_1181756465_1162600547_0 $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/temporary-db_255 Note: If the archived db was compressed, be sure to uncompress the contents in the temporary directory. 2. Rename the directory you just copied into the thawed directory to something that Splunk will recognize: cd $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/ mv temporary-db_1181756465_1162600547_0 db_1181756465_1162600547_0 Note: This examples assumes that the bucket id '0' does not conflict with any other bucket in the main (defaultdb) index. If it does, you will have to move the bucket to a non-conflicting bucket ID. 3. Refresh the manifests: cd $SPLUNK_HOME/bin ./splunk login ./splunk _internal call /data/indexes/main/rebuild-metadata-and-manifests After a few moments, the contents of your newly thawed buckets should be searchable again. ... View more

What does following Error message means ? ERROR BucketMover - coldToFrozenScript exited with non-zero status: exited with code 2 ... View more

Hi, I could not able to Restore archived data and could not able to make it searchable even after following Restore archived data instractions in Splunk Admin Manual. Can any one please help on this. ... View more

Hi, I have configured following parameters for testing the log Archiving for one of my index named "os". But it is not working as per the configured parameters as the data from hot+warm bukets is rolled to cold but the data has not rolled from cold buket to frozen achive location. Instead of that the cold buket size and number is keep on growing. Please do let me know if the parameters provide by me are worng or how can i test the logs are archiving on the given location. etc/apps/index.conf [os] homePath = $SPLUNK_DB2/os/db coldPath = $SPLUNK_DB2/os/colddb thawedPath = $SPLUNK_DB2/os/thaweddb coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os maxWarmDBCount = 5 maxHotBuckets = 1 maxDataSize = 10 maxTotalDataSizeMB = 1000 frozenTimePeriodInSecs = 1800 Storage bukets as per above parameters: 8.0K ./db/db_1329748885_1329748067_16/rawdata/.compressedAddresses 664K ./db/db_1329748885_1329748067_16/rawdata 824K ./db/db_1329748885_1329748067_16 8.0K ./db/db_1329749807_1329749597_18/rawdata/.compressedAddresses 200K ./db/db_1329749807_1329749597_18/rawdata 304K ./db/db_1329749807_1329749597_18 8.0K ./db/db_1329751849_1329749838_19/rawdata/.compressedAddresses 1.6M ./db/db_1329751849_1329749838_19/rawdata 1.8M ./db/db_1329751849_1329749838_19 8.0K ./db/db_1329749567_1329748907_17/rawdata/.compressedAddresses 508K ./db/db_1329749567_1329748907_17/rawdata 648K ./db/db_1329749567_1329748907_17 8.0K ./db/GlobalMetaData 8.0K ./db/hot_v1_21/rawdata/.compressedAddresses 3.3M ./db/hot_v1_21/rawdata 3.8M ./db/hot_v1_21 8.0K ./db/db_1329809830_1329751878_20/rawdata/.compressedAddresses 3.5M ./db/db_1329809830_1329751878_20/rawdata 7.1M ./db/db_1329809830_1329751878_20 15M ./db 8.0K ./colddb/db_1323792035_1323791901_8/rawdata/.compressedAddresses 244K ./colddb/db_1323792035_1323791901_8/rawdata 356K ./colddb/db_1323792035_1323791901_8 8.0K ./colddb/db_1328056408_1327030688_9/rawdata/.compressedAddresses 68M ./colddb/db_1328056408_1327030688_9/rawdata 135M ./colddb/db_1328056408_1327030688_9 8.0K ./colddb/db_1329748045_1329747137_15/rawdata/.compressedAddresses 780K ./colddb/db_1329748045_1329747137_15/rawdata 948K ./colddb/db_1329748045_1329747137_15 8.0K ./colddb/db_1329747107_1329746717_14/rawdata/.compressedAddresses 380K ./colddb/db_1329747107_1329746717_14/rawdata 508K ./colddb/db_1329747107_1329746717_14 8.0K ./colddb/db_1329746687_1329745996_13/rawdata/.compressedAddresses 636K ./colddb/db_1329746687_1329745996_13/rawdata 788K ./colddb/db_1329746687_1329745996_13 8.0K ./colddb/db_1297617319_1291336726_0/rawdata/.compressedAddresses 179M ./colddb/db_1297617319_1291336726_0/rawdata 399M ./colddb/db_1297617319_1291336726_0 8.0K ./colddb/db_1329737474_1328056434_10/rawdata/.compressedAddresses 107M ./colddb/db_1329737474_1328056434_10/rawdata 213M ./colddb/db_1329737474_1328056434_10 8.0K ./colddb/db_1312010101_1308010497_3/rawdata/.compressedAddresses 178M ./colddb/db_1312010101_1308010497_3/rawdata 402M ./colddb/db_1312010101_1308010497_3 8.0K ./colddb/db_1303821315_1297617349_1/rawdata/.compressedAddresses 117M ./colddb/db_1303821315_1297617349_1/rawdata 363M ./colddb/db_1303821315_1297617349_1 8.0K ./colddb/db_1322968195_1319178356_6/rawdata/.compressedAddresses 190M ./colddb/db_1322968195_1319178356_6/rawdata 395M ./colddb/db_1322968195_1319178356_6 8.0K ./colddb/db_1308010467_1303821327_2/rawdata/.compressedAddresses 176M ./colddb/db_1308010467_1303821327_2/rawdata 397M ./colddb/db_1308010467_1303821327_2 8.0K ./colddb/db_1323791855_1322968211_7/rawdata/.compressedAddresses 44M ./colddb/db_1323791855_1322968211_7/rawdata 96M ./colddb/db_1323791855_1322968211_7 8 .0K ./colddb/db_1329745010_1329737477_11/rawdata/.compressedAddresses 5.8M ./colddb/db_1329745010_1329737477_11/rawdata 6.4M ./colddb/db_1329745010_1329737477_11 8.0K ./colddb/db_1315568232_1312010124_4/rawdata/.compressedAddresses 197M ./colddb/db_1315568232_1312010124_4/rawdata 399M ./colddb/db_1315568232_1312010124_4 8.0K ./colddb/db_1329745970_1329745037_12/rawdata/.compressedAddresses 844K ./colddb/db_1329745970_1329745037_12/rawdata 1020K ./colddb/db_1329745970_1329745037_12 8.0K ./colddb/db_1319178335_1315568261_5/rawdata/.compressedAddresses 192M ./colddb/db_1319178335_1315568261_5/rawdata 400M ./colddb/db_1319178335_1315568261_5 3.2G ./colddb 8.0K ./thaweddb 3.2G . 3.2G total ... View more

Hi, I am testing automatic Log Archiving for my Splunk Deployment. i am testing this on one of my single index named OS. For auto Archiving i have configured "coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os" the location where i want to archive the data for OS index. Along with that i have configured following paramenter in my customizied Indexes.conf file to test Archiving by rolling data from hot/warm/cold to frozen to check some data at my archiving location.But i coud not able to see any data in my archiving location can any one please let me know where i am worng and how should i configre this ? [os] homePath = $SPLUNK_DB2/os/db coldPath = $SPLUNK_DB2/os/colddb thawedPath = $SPLUNK_DB2/os/thaweddb coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os maxHotBuckets = 5 maxHotSpanSecs = 3600 maxHotBuckets = 1 maxDataSize = 100 maxTotalDataSizeMB = 2000 frozenTimePeriodInSecs = 3600 ... View more

How can create a table containg date and time of oldest and most recent log per index in splunk ? ... View more