Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jkamdar
jkamdar
Engager
Member since:
07-03-2013
05-15-2023
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 07-03-2013 |
Activity Feed
- Posted How can I monitor status of "All Data is Searchable, Search Factor is Met, Replication Factor is Met" using CLI? on Monitoring Splunk. 10-12-2022 08:17 AM
- Posted Re: Why does my Splunk process on my search head show not available abruptly? on Monitoring Splunk. 10-06-2022 04:48 AM
- Karma Re: Why does my Splunk process on my search head show not available abruptly? for richgalloway. 10-06-2022 04:48 AM
- Posted Why does my Splunk process on my search head show not available abruptly? on Monitoring Splunk. 10-05-2022 08:08 AM
- Posted Re: How to copy saved searches, dashboards, alerts, etc. from a single instance to a search head and indexer clustering environment? on Deployment Architecture. 06-12-2018 10:40 AM
- Posted Re: How to copy saved searches, dashboards, alerts, etc. from a single instance to a search head and indexer clustering environment? on Deployment Architecture. 06-11-2018 11:21 AM
- Posted Re: Moving the license key from one license master to another -- Are there any potential issues? on Installation. 06-06-2018 07:20 AM
Topics I've Started
10-12-2022
08:17 AM
On my Splunk Master node, I can check the status if "All Data is Searchable, Search Factor is Met, Replication Factor is Met". Is there a way to check the status using CLI? Or what's the best way to set an alert, so if there is any issue, it emails me?
... View more
Labels
10-06-2022
04:48 AM
Good point, I will check it out, thanks.
... View more
10-05-2022
08:08 AM
I have noticed that Splunk process on my development search-head shows not available abruptly. And then it becomes available. One of those time, I check the status of Splunk service and below is the output. Not sure, where to check and how to troubleshoot this problem. I was just assigned this problem, so not sure how often it happens but I have wrote a cronjob to check the status every 5 minutes and got an alert that it happened last night around 3am. But as far as I know, there is no pattern to it.
systemctl status splunk
splunk.service - Splunk Enterprise
Loaded: loaded (/etc/systemd/system/splunk.service; enabled; vendor preset: disabled)
Active: deactivating (stop-sigterm) (Result: exit-code) since Mon 2022-10-03 10:45:41 EDT; 41s ago
Main PID: 76827 (code=exited, status=8)
CGroup: /system.slice/splunk.service
└─78229 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_TA_f5-bigip/bin/Splunk_TA_f5_bigip_main.py
Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: [ OK ]
Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: All installed files intact.
Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: Done
Oct 03 10:02:52 splunkbdev01.xxx.xxx splunk[76759]: All preliminary checks passed.
Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: Starting splunk server daemon (splunkd)...
Oct 03 10:02:52 splunkdev01.xxx.xxx splunk[76759]: Done
Oct 03 10:04:31 splunkdev01.xxx.xxx sudo[78359]: splunk : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/netstat -anp
Oct 03 10:04:31 splunkdev01.xxx.xxx sudo[78359]: pam_unix(sudo:session): session opened for user root by (uid=0)
Oct 03 10:04:43 splunkdev01.xxx.xxx systemd[1]: Started Splunk Enterprise.
Oct 03 10:45:41 splunkdev01.xxx.xxx systemd[1]: splunk.service: main process exited, code=exited, status=8/n/a
... View more
Labels
- Labels:
-
splunkd
06-12-2018
10:40 AM
@SloshBurch, thanks for your response.
Thanks for the link to the document. That's the document I started with, the section - Migrate settings to a search head cluster. As I was going through the steps, I was little confused.
Following those steps, we did migrated with a couple of apps and it looked like, the permission didn't migrated properly. Here is the observation by the owner app:
Everything came over, except a private search owned by the user. My guess is that even though the user exists, he never logged on, so his home directory didn't exist.
Private search, tags, and eventtype belonging to another user now has No Owner permissions change to be shared to the app: Everyone read/write.
The app was owned by no-one and Maybe it was because, we didn't copy user(s).
So, as I read your response, you are confirming that, copying those 2 directories (/etc/apps and /etc/users) will take care of migrating everything, please confirm? Sorry, if I am being overly concerned.
... View more
06-11-2018
11:21 AM
Thanks @sloshburch. We are in the process of doing the same thing from the stand-alone SH to cluster using a deployer. I am concerned about all the Knowledge objects.
So, copying $SPLUNK_HOME/etc/users $SPLUNK_HOME/etc/apps at once to deployer and finally to all the cluster member, will it migrate all the knowledge objects? I am afraid, I will mess it up 😞
... View more
06-06-2018
07:20 AM
@saurabh_tek11 thanks for these easy steps. I have a question about "Just add the license key on new LM". Do I just copy files from my current master /opt/splunk/etc/licenses/enterprise to the new Splunk server that I want to promote as a master. I have 34 files in that directory.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-15-2023
11:02 AM
|
