Thanks for this solution. it worked for me. I went ahead and made my Monitoring Console as standalone.  that fixed the issue.  ... View more

It's all good - we all make all sorts of mistakes... ... View more

Finally solved this! Here is what I did: Changed the admin password default value on the new Indexer A. Run: splunk edit user admin -password new_value -role admin -auth admin:changeme I added the register_replication_address and register_search_address to the new indexer server.conf file under [clustering] Note: Use the indexer IP, not the VPN IP value I reset the pass4Symmkey value for ALL indexers, current and new; and the search head as well. This is done by just putting the same plain text value in each and resetting splunk I went to the Search Head UI, and went to Distributed Management Console -> Settings -> General Setup and then went to Edit -> Edit Server Roles for the new Indexer. I did not actually change anything, but still hit save and Apply Changes. Apparently this is a known bug! ... View more

The following page speaks a bit about it - About metrics.log It mentions current_size but not current_size_kb . It says - -- Most of these values are not interesting. But current_size , especially considered in aggregate, across events, can tell you which portions of Splunk indexing are the bottlenecks. If current_size remains near zero, then probably the indexing system is not being taxed in any way. If the queues remain near 1000, then more data is being fed into the system (at the time) than it can process in total. ... View more

Wow, you are awesome. That worked perfectly. Thank you so much! ... View more

Thanks and no need to say sorry! ... View more

The issue was solved when the service user for splunk had it's permissions updated ... View more

Hello Everyone, I am using the below in indexes.conf file, but the script never got executed instead the frozen files are deleted. frozenTimePeriodInSecs = 1382400 coldToFrozenScript = "/opt/splunk/bin/python" "/opt/splunk/etc/apps/atl-cold-to-frozen-s3/bin/coldToFrozenS3.py" Do I need to create sub folders on S3 bucket? because manually executing the script, without the sub folders works. However if I manually execute the script something like "python coldtofrozens3.py arguments", its copying the data to s3. Also I have tried coldToFrozenDir=, which is working. But the coldtofrozen script never works. I am unable to test the script, as i am losing the frozen data. Can some one please help/suggest what is going wrong here. ... View more

This worked for me! The UI did not work for me earlier because the value for sslKeysfilePassword in server.conf was wrong, so I just commented it out since we use the default ssl from splunk. Thanks MuS! ... View more

Just added some drop-downs to the license page so that you can select the sourcetype, so make sure you get v1.6.2. No Splunk restart required. ... View more

Thank you! This worked perfectly! I created a new field subtracting max_time by min_time to get total seconds ... View more

This looks like the csv's have a long header that is the same for all csv files. Then splunk reads the first bytes of the files and if they are the same, the file will not be processed, because splunk think it is the same file. ... View more

Nice, this worked as well. Thank you! ... View more

Your solution worked perfectly for the pizza/baseball sample I provided, thank you. You are right though, it mixes them up together, so it would not be ideal for my real world scenario. ... View more

Awesome! That worked perfectly. Thank you! ... View more