this one is the goat. 🐐 i have 5 events with 4 mv fields with around 4000 values each.  so im expecting around 20k of rows. mvexpand was giving the message, i started with truncated at 300... i did the fields +/- was able to get it up to truncated at 1100.  still not enough.   This Splunk Answers from 2020 did it. cheers to you  @to4kawa @gjanders  🍺 ... View more

Im having the a similar issue on version 3.0.2.  We have 2 hfs, one has configurations set, the other newly built hf with no configurations set.  Both do not show inputs correcty. How were you able to solve your issue? ... View more

also noticing that data stops coming in when the access_token have expired. typically these has a lifetime of 60 minutes. The only way for data to resume is for a restart of the heavy forwarder. There may be an issue with refreshing the tokens. It does not appear that this is happening successfully or properly. Another observation is when the heavy forwarder has been turned off overnight as an AWS test instance, the morning start does not resume the data feed. a restart is required to resume the feed. do i need to log a support ticket to this question? thanks ... View more

I am experiencing the same issue after upgrading from ubuntu 17.04 to 17.10. I then upgraded from splunk 6.6.3 to 6.6.5 hoping that this is resolve in this patch. IT IS NOT. Did a fresh install of splunk 6.6.5, issues is still NOT RESOLVED. Splunk> Now with more code! Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open ERROR: pid 19180 terminated with signal 9 Checking kvstore port [8191]: open Checking configuration... Done. Creating: /opt/splunk/var/lib/splunk Creating: /opt/splunk/var/run/splunk Creating: /opt/splunk/var/run/splunk/appserver/i18n Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css Creating: /opt/splunk/var/run/splunk/upload Creating: /opt/splunk/var/spool/splunk Creating: /opt/splunk/var/spool/dirmoncache Creating: /opt/splunk/var/lib/splunk/authDb Creating: /opt/splunk/var/lib/splunk/hashDb New certs have been generated in '/opt/splunk/etc/auth'. Checking critical directories... Done ERROR: pid 19199 terminated with signal 9 Validating databases (splunkd validatedb) failed with code '-1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue ... View more