Short documentation reminder: https://docs.splunk.com/Documentation/DBX/3.18.2/DeployDBX/Prerequisites "KV store must also be active and working properly as of DB Connect version 3.10.0 and higher" ... View more

My SHC captain displayed the message: Checking http port [8000]: not available ERROR: http port [8000] - port is already bound. Splunk needs to use this port. Would you like to change ports? [y/n]: Killing the pid correlated to port 8000 worked. ... View more

When you're trying to install apps from Splunkbase it asks for your splunk.com user so that you Splunk can pull the app from there. It has nothing to do with your local users. ... View more

Knowing that its a very very old thread, still at this hour we are stuck with the same issue. So we are trying to send the data from Splunk heavy forwarder to a third party destination and the connectivity looks fine but the outputs, props & transforms config that we have done does not seem to be working. I need an urgent help at this case if somebody can ??? This is how our config looks like now: outputs.conf: [tcpout] defaultGroup = nothing disabled = false   [tcpout:datab] server = x.x.x.x:xxxx sendCookedData = false compressed = false   props.conf [host::x.x.x.x] TRANSFORMS-x.x.x.x = route_datab #SHOULD_LINEMERGE = false     transforms.conf [route_datab] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = datab ... View more

@Damien_Dallimor Thanks man, this worked perfectly. Youre a rockstar! I want to add that I was able to set the host name using regular expression in path and created multiple indices by recreating the folder structure of the raw logs thanks to your method. Worked like a charm 👍 Thanks once again. ... View more

Write a script to rebuild the files. ... View more

Here is way to do it via SPL: | rest splunk_server=local count=1 /services/server/info | table kvStoreStatus ... View more

Hello Rich, it's our case and seeing no major problem with same VM for DS/CM with Splunk Enterprise 7.3.4, 900+ UF, 3 indexers, ~250 gb/day. However in the docs : https://docs.splunk.com/Documentation/Splunk/8.1.2/Updating/Planadeployment#Deployment_server_and_other_roles A cluster manager node and a deployment server both consume significant system resources while performing their tasks. The manager node needs reliable and continuous access to resources to perform the ongoing management of the cluster, and the deployment server can easily overwhelm those resources while deploying updates to its deployment clients. Do you think no problem when we'll upgrade to Splunk 8.1? Thanks. ... View more

Hi - Splunk TS found the issue where port 8088 is being used by the other process. So, don't put port entry 8088 in your inputs.conf file. ... View more

Thank you all. The issue was that the Linux admin renamed file splunkd.pid and assume this file would be recreated once Splunk restarted, but it didn't. Rename the file back to its original doesn't work, so this file needs to be manually recreated. Thanks, ... View more

Hi, How can I regex <Type> Read Only </Type> to get "Read Only"? I mean only yield text between the tags. Thanks, ... View more

It got eaten again. Re-edit your original question, highlight the stuff that is getting changed and then click the 101010 button to make it a code fragment that will not get modified. ... View more

That fixed it. Thank you. ... View more

you are welcome 🙂 ... View more

Hi Probably same events are sent also to local /var/log/messages and other files under /var/log directory? You should start to look there. Ismo ... View more

Usually those are created e.g. some syllogism variant not Splunk. You should figure out which tool is used on your environment to deliver / received those logs. Many times it is syslog, syslog-ng or rsyslog. And on network topology there could be a load balancer before those HF hosts to distribute events to all of those hosts. And probably there is also some log rotation tools to rotate and zip those logs? R. Ismo ... View more

There is an app to define volume:primary and other stanza like cold/summary that pushed down to the indexers. You can control the log storage and location from that app. Thank you everyone. ... View more

This is a great guide to setting up syslog with Splunk. Enjoy! Splunk Success with Syslog ... View more

Hi Richgalloway, I'd like to circle back on HFs stopped receiving logs. All logs were once received well after system admin fixed the daemon log. Then last Thursday, HFs suddenly stopped receiving 9 out of 10 logs at almost same time. There is no issue with new logs. Disk space and network connection are not the cause. Would you please share what you think? Thank you, ... View more

Sorry for the delay. Here is a good query that I don't know the source, but it works very well: index=_internal source=*metrics.log group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | rename connectionType as connectType | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder") | eval version=if(isnull(version),"pre 4.2",version) | rename version as Ver | fields connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver | eval Indexer= splunk_server | eval Hour=relative_time(_time,"@h") | dedup sourceIp | stats avg(tcp_KBps) sum(tcp_eps) sum(tcp_Kprocessed) sum(kb) by Hour connectType sourceIp sourceHost destPort Indexer Ver | fieldformat Hour=strftime(Hour,"%x %H") ... View more

Giuseppe - Really appreciate your help. ... View more