I am not sure how to configure the indexes.conf AND the splunk-launch.conf. I understand multiple volumes in indexes.conf, such as: [volume:hotwarm] path = /splunkindexes/hot [volume:cold] path = /splunkdata and using this in the index definition in indexes.conf: [main] homePath = volume:hotwarm/defaultdb/db coldPath = volume:cold/defaultdb/colddb thawedPath = $SPLUNK_DB/defaultdb/thaweddb repFactor = auto I have the splunk-launch.conf set as: SPLUNK_HOME=/splunk SPLUNK_DB = /splunkindexes/hot setting the SPLUNK_DB to the hotwarm volume. I am not seeing the cold volume data. I just made these changes, and have the hot to cold rollover set "disk size", so it will stay hot until the disk is close to full then it will roll to cold. Any ideas on way I cannot see the existing cold data? Thanks... ... View more

We are trying to connect a Mobileiron built-in Splunk forwarder to an indexer cluster. At best we get an intermittent connection. Whenever we recycle the Mobileiron splunk daemon we see the following message from an indexer: timestamp INFO TcpInputProc - clustering is enabled but ACK not enabled on forwarder=ip_address We do not get any other messages after this. Shouldn't an indexer accept a connection whether useAck is loaded or not from a forwarder? Are there any indexer configurations to accept useAck=false (default)? ... View more

I have several AIX forwarders that are not liking what I think is a simple monitor. We are looking for 1 file to ingest, the read permissions are in place for the file. The _internal files are being ingested. From the forwarder everything appears correct, and from the deployment server everything appears correct. Only the 1 desired file is not being monitored. Please tell me what I am doing wrong. Forwarder version 6.3.1 Here's the inputs.conf [monitor:///home/notes/notesr4/IBM_TECHNICAL_SUPPORT/console.log] _TCP_ROUTING=test_cluster index=t_webapp sourcetype=COTS:Notes Here's the outputs.conf [tcpout] defaultGroup = test_cluster indexAndForward = false [tcpout:test_cluster] server = indexer1:9997,indexer2:9997 autoLB = true useACK = true maxQueueSize = 7MB Here are the _internal messages types: 02-05-2016 12:35:53.181 -0500 ERROR TailingProcessor - Ran out of data while looking for end of header 02-05-2016 09:43:00.622 -0500 WARN DistributedPeerManager - feature=DistSearch not enabled for your license level 02-05-2016 09:43:00.349 -0500 WARN ClusteringMgr - Ignoring clustering configuration, the active license disables this feature. 02-05-2016 09:42:57.293 -0500 WARN ulimit - Core file generation disabled I'm looking into the ulimit message Here are the forwarder CLI results for forward-server and monitor kodiak:/splunkforwarder/bin> ./splunk list forward-server Active forwards: indexer1:9997 Configured but inactive forwards: indexer2:9997 kodiak:/splunkforwarder/bin> ./splunk list monitor Monitored Directories: $SPLUNK_HOME/var/log/splunk/splunkd.log /splunkforwarder/var/log/splunk/audit.log /splunkforwarder/var/log/splunk/btool.log /splunkforwarder/var/log/splunk/conf.log /splunkforwarder/var/log/splunk/first_install.log /splunkforwarder/var/log/splunk/license_audit.log /splunkforwarder/var/log/splunk/license_usage.log /splunkforwarder/var/log/splunk/metrics.log /splunkforwarder/var/log/splunk/mongod.log /splunkforwarder/var/log/splunk/remote_searches.log /splunkforwarder/var/log/splunk/scheduler.log /splunkforwarder/var/log/splunk/searchhistory.log /splunkforwarder/var/log/splunk/splunkd-utility.log /splunkforwarder/var/log/splunk/splunkd.log /splunkforwarder/var/log/splunk/splunkd_access.log /splunkforwarder/var/log/splunk/splunkd_stderr.log /splunkforwarder/var/log/splunk/splunkd_stdout.log /splunkforwarder/var/log/splunk/splunkd_ui_access.log $SPLUNK_HOME/var/spool/splunk/...stash_new Monitored Files: $SPLUNK_HOME/etc/splunk.version /home/notes/notesr4/IBM_TECHNICAL_SUPPORT/console.log All suggestions are welcome...thanks in advance ... View more

Is there a way to change the default of "10 lines" in Forwarder Management? I find it extremely annoying that this page, unlike most other pages in Splunk, will not remember the last setting for this area. I have many more forwarders, applications, and server classes than 10, and it really slows me down when I have to add many new apps/server classes, which presently is often. ... View more