Yes, all data is  one place, HF does routing .  We are trying see if moving the routing  to indexer helps and also we are trying to find a scalable solution. The only way as of now is to view contents. I will add couple HF see if that helps. Thank you! ... View more

Hi @bsrikanthreddy5m, id DMC, you can have all the informations you need. how many events you have in each index, home many storage you're using for each index. If you want to customize searches, you could start from the DMC searches; e.g. to have the Total event count and the storage usage, you could see at [Settings -- Monitoring Console -- Indexing -- Indexes and Volums -- Indexes and Volums:Instance], or run the relative search | rest splunk_server=DESKTOP-KBVMP9Q /services/data/indexes | join title type=outer [ | rest splunk_server=DESKTOP-KBVMP9Q /services/data/indexes-extended | eval cold_bucket_size = if(isnotnull('bucket_dirs.cold.bucket_size'), 'bucket_dirs.cold.bucket_size', 'bucket_dirs.cold.size') | fields title, cold_bucket_size, total_size, total_bucket_count] | `dmc_exclude_indexes` | fields title datatype maxTotalDataSizeMB currentDBSizeMB frozenTimePeriodInSecs minTime coldPath.maxDataSizeMB homePath.maxDataSizeMB, homePath, coldPath, cold_bucket_size, total_size, total_bucket_count, totalEventCount | eval currentDBSizeGB = if(isnotnull(currentDBSizeMB), round(currentDBSizeMB / 1024, 2), 0) | eval maxTotalDataSizeGB = if((maxTotalDataSizeMB == 0) OR isnull(maxTotalDataSizeMB), "unlimited", round(maxTotalDataSizeMB / 1024, 2)) | eval disk_usage_gb = currentDBSizeGB." / ".maxTotalDataSizeGB | eval currentTimePeriodDay = round((now() - strptime(minTime,"%Y-%m-%dT%H:%M:%S%z")) / 86400, 0) | eval currentTimePeriodDay = if(isnull(currentTimePeriodDay), 0, currentTimePeriodDay) | eval frozenTimePeriodDay = round(frozenTimePeriodInSecs / 86400, 0) | eval frozenTimePeriodDay = if(isnull(frozenTimePeriodDay) OR frozenTimePeriodDay == 0, "unlimited", frozenTimePeriodDay) | eval freeze_period_viz = currentTimePeriodDay." / ".frozenTimePeriodDay | eval total_bucket_count = if(isnotnull(total_bucket_count), total_bucket_count, 0) | eval totalEventCount = if(isnotnull(totalEventCount), totalEventCount, 0) | eval home_bucket_size_gb = round((total_size - if(isnull(cold_bucket_size), 0, cold_bucket_size)) / 1024, 2) | eval home_bucket_size_gb = if(isnull(home_bucket_size_gb), 0, home_bucket_size_gb) | eval home_bucket_capacity_gb = if(isnull('homePath.maxDataSizeMB') OR 'homePath.maxDataSizeMB' = 0, "unlimited", round('homePath.maxDataSizeMB' / 1024, 2)) | eval home_bucket_usage_gb = home_bucket_size_gb." / ".home_bucket_capacity_gb | eval cold_bucket_size_gb = if(isnull(cold_bucket_size), 0, round(cold_bucket_size / 1024, 2)) | eval cold_bucket_capacity_gb = if(isnull('coldPath.maxDataSizeMB') OR 'coldPath.maxDataSizeMB' = 0, "unlimited", round('coldPath.maxDataSizeMB' / 1024, 2)) | eval cold_bucket_usage_gb = cold_bucket_size_gb." / ".cold_bucket_capacity_gb | fields title, datatype, freeze_period_viz, disk_usage_gb, home_bucket_usage_gb, cold_bucket_usage_gb, total_bucket_count, totalEventCount, currentDBSizeGB, cold_bucket_size_gb, home_bucket_size_gb, homePath, coldPath | fields title, datatype, freeze_period_viz, disk_usage_gb, home_bucket_usage_gb, cold_bucket_usage_gb, totalEventCount, total_bucket_count | eval total_bucket_count=tostring(total_bucket_count, "commas") | eval totalEventCount=tostring(totalEventCount, "commas") | rename title as Index, datatype as "Data Type", disk_usage_gb as "Index Usage (GB)", freeze_period_viz as "Data Age vs Frozen Age (days)", home_bucket_usage_gb as "Home Path Usage (GB)", cold_bucket_usage_gb as "Cold Path Usage (GB)", total_bucket_count as "Total Bucket Count", totalEventCount as "Total Event Count" Obviously you can use the time period you need. Ciao. Giuseppe ... View more

I have added below stanza on my on-prem indexes.conf and server.conf indexes.conf [volume:splunk] storageType = remote path = s3://<bucketName> remote.s3.endpoint = https://s3.us-east-2.amazonaws.com remote.s3.encryption = sse-kms remote.s3.kms.key_id = remote.s3.access_key = remote.s3.secret_key = Server.conf [cachemanager] max_concurrent_uploads = 2 eviction_policy = noevict hotlist_recency_secs = 3888000 adding remotePath = volume:splunk/$_index_name specific index which I plan to migrate and rolling restart the indexer cluster.  I am using below commands to compare  the event count .   | tstats count where index=<IndexName> by index | dbinspect index=<IndexName> | dedup bucketId |  stats sum(eventCount) by index I am monitoring the migration status using  below command on CM. /opt/splunk/bin/splunk search "|rest /services/admin/cacheman/_metrics |fields splunk_server migration*" -auth admin:$(cat /etc/splunk/password) .    ... View more

One cannot move data from one index to another.  Once the data is in an index it stays there until it ages out or is removed to make room for newer data. NEVER mess with Splunk's S3 buckets.  Do so at your own risk and be prepared for a Bad Day. ... View more

Probably you should keep inventory for members of that SHC nodes and in regular base run alert which check current situation towards that inventory. When there are changes then update inventory also. I cannot check exactly commands now, but you could use rest + internal indexes to get those information. More about those e.g. https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-REST-API-call-for-getting-the-status-of-a-Search-Head/m-p/142850 r. Ismo ... View more

When you are using “ instead of ‘ those variables etc will be expanded on command line. ... View more

yes, I have used an all-time in time picker.  ... View more

After adding  below on the forwarder, the slow indexing issue was fixed.  outputs.conf [tcpout:p2s] maxQueueSize = 7MB ... View more

It's been my experience that most customers leave $SPLUNK_DB commented out in splunk-launch.conf and let the index locations be specified by index.conf files. When you change the default location you are also changing the expected location of existing indexes and/or summaries.  Therefore, it's important to move the existing files to the new location.  The sequence is: Edit indexes .conf Run btool check to check the config files Stop the indexer Move files from the old location to the new one Start the indexer ... View more

Recommendation from Splunk PS: SSE-C (Customer Managed Keys) This is the recommended option in the documentation but this will change very soon. Advantages The self-managed key so there is an element of trust as the creator/generator of the key. No KMS API operation limits to contend with. Disadvantages Keys are in plain text on the indexes.conf file. This would not pass a security risk assessment. Advanced key management requires an advanced key management solution e.g. Hardware Security Modules for storage and management. To rotate keys, you need to move the data from SmartStore back to an EBS volume and re-upload the data with the new key. Splunk cannot be running during this operation. This is by far the biggest drawback. SSE-C while technically valid requires more due care of the customer to ensure adequate protection of the data and is subject to human error and misconfiguration. It is only appropriate for customers with specific requirements to use customer-managed keys. SSE-KMS has Amazon manage your keys for you and is more flexible than SSE-C. There are limits that are described here: https://docs.aws.amazon.com/kms/latest/developerguide/limits.html ... View more