About mabonjean

mabonjean · ‎04-19-2022

Same question on my side. I want to collect Azure China logs from a Splunk platform host in an AliYun environnent.

mabonjean · ‎01-02-2020

Hi Nick, Thanks for your reply. We solve (I expect permanently) my issue with cleaning all local KVStore. The cause is somes old lookups files (old from months ago) can't be delete by Splunk. When I clean a local KVstore, the non replicated old lokkup files are replicate after the cleaning. I'll check you answer and make sur that all is ok with my apps. I'll make a return after. Thank you.

mabonjean · ‎04-08-2019

Hi, I use on my Search Head Cluster (with 80GB of disk space for each SH) the application "Splunk App Windows Infrastructure" that's carrying several kvstores and collections configurations. Theses KVStore consummed all the disk space. I must disable several scheduled tasks. Mainly all kvstore and lookups updates tasks. My problem is still here. This app still consummed my disk space and the KVStore doesn't rotate old data. I won't clean it to prevent losts of valuables datas. How can I modify / optimize the configuration to stop the high disk consummation ? Best regards.

mabonjean · ‎12-27-2018

Thanks @p_gurav, Your request is really helpfull. With it, I can easily see what I want.

mabonjean · ‎12-26-2018

I don't a forgotten elements in my question. I select the Deployment Server as host in my request. When I list all clientip, I have more client than I have in the Deployment Server. Ma main question is : what is "clientip" ? Which data does it contains ?

mabonjean · ‎12-26-2018

Hi, I want to list all Deployment client on a dashboard in my Search Head with the following request: index=_internal host="my Deployment Server" | dedup clientip |table clientip [...] In the result, I have the list of my Deployment Client, The Deployment Server, localhost loop and serveral proxy IP. The fowarding management of theses proxies aren't in my cluster then it's my Deployment Server which manage them. They are fully independant of my client pool and I don't collect their logs. In the fowarding management menu, I don't see these clients. What exactly contains the fields "clientip" of Splunk internal logs ? And why I see theses proxy address in my Deployment Server clientip ? any idea ? Thank you. Best regards

Posts	7
Solutions	0
Karma Given	2
Karma Received	3
Member Since	‎12-26-2018

Online Status	Offline
Date Last Visited	‎04-19-2022 12:32 PM

Splunk app Windows Infrastructure - kvstore disk s...

splunk internal logs, precisions on the "clientip"...

Re: Does Splunk Add-on for Microsoft Cloud Service...

Re: Splunk app Windows Infrastructure - kvstore di...

Splunk app Windows Infrastructure - kvstore disk s...

Re: splunk internal logs, precisions on the "clien...

Re: splunk internal logs, precisions on the "clien...

splunk internal logs, precisions on the "clientip"...