To add to the above details, the "thaweddb" folder is blank and doesn't contain any buckets. For now, I have increased the "frozenTimePeriodInSecs" by a few more months, but I'm not sure if it will work. Any other advice would be very helpful. ... View more

Thank you, I randomly ran it for a few buckets and observed the following message: Moving bucket='rb_1681312487_1677890027_1731_FBA51F26-2043-4798-B18D-2D637A7347B9', initiating warm_to_cold: from='/Data/splunkdb/o365/db' to='/Data/splunkdb/o365/colddb', caller='chillIfNeeded', reason='maximum number of warm buckets exceeded'. I'm not sure if this is the reason that could be affecting the data retention period. Initially, I had "maxHotBuckets = 10" defined, but it's no longer defined, and I've left it as the default value. [test] coldPath = volume:primary/test/colddb homePath = volume:primary/test/db thawedPath = $SPLUNK_DB/test/thaweddb maxTotalDataSizeMB = 512000 frozenTimePeriodInSecs = 39420043 ... View more

You can use the following on Search Head: index=_internal source=*license_usage.log type=Usage pool=* | eval _time=strftime(_time,"%m-%d-%y") | stats sum(b) as ub by _time | eval ub=round(ub/1024/1024/1024,3) | eval _time=strptime(_time,"%m-%d-%y") | sort _time | eval _time=strftime(_time,"%m-%d-%y") | rename _time as Date ub as "Daily License Quota Used" You can define the "Date Range" to get daily usage. ... View more

Hello Everyone, Regrettably, the oldest available data across all indexes has been reduced to approximately 7 months. I have already conducted the following checks: Current index size: Less than 200GB (configured for 500GB) Indexers Disk Size (Cluster): All indexes currently have 30-35% free space. frozenTimePeriodInSecs=39420043 (approximately 15 months) Any assistance with troubleshooting would be greatly appreciated. Thank you.     ... View more

Hi, did you able to fix the issue ?   ... View more

Thanks @richgalloway , It worked !! I can see dashboards filled with contents but not sure if ES is able to utilize all indexes. Are there any links to documentation, videos which will help understand and build correlations & investigations. ... View more

Had similar issue when I upgraded the app from version 1.0.0 to 4.0.2.  Reverted back to version 1.0.0 which seems to fix the issue. ... View more

I still can't find anything which will lead to a solution. Any suggestion will be of great help! ... View more

@krylov : Did you manage to find the solution... I have similar issue where server.pem certificate is valid and also regenerated mongo DB. ... View more

Thanks @SanjayReddy , I ran the script and see following details: This issue is not specific to one index but with almost all has oldest data of 270 days. ... View more

I did, the size defined is 500GB and most of the indexes are around 300-400GB. ... View more

Thanks for replying, but I am looking something for Azure data. ... View more

I am in same situation, did you find anything to visualize Eventhub data on Splunk. ... View more

Not sure if its going to help but I re-install DUO app which fixed my issue. ... View more

I went ahead and removed log4j files from the specified locations. Although I get a Splunk alert which is expected (As per Splunk, it can be ignored), but the scan is clean.  I am planning to follow the same on other Splunk servers. Here is the URL for reference: https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html "Upon removal of these jar files, an administrator may see errors at Splunk startup pertaining to file integrity, specific to these jar files. These are expected as you are removing these unused jar files as a workaround. These errors may be ignored. " ... View more

Hi, Our scan has too found log4j vulnerability under the path /opt/splunk/var/run/searchpeers/<host>... Did you remove those files/folders from the location ? Thanks, ... View more