ok great. Thanks for the response. we will try to implement the retention. ... View more

Ah, good to know! And glad you got it resolved! ... View more

Thanks for the response. Yes, the new index exist on all the indexers and i have restarted the forwarder. checked if the index name has changed on the server by the application team and it has the new index in the inputs.conf but still it is ingesting to the old index. ... View more

Thanks for the response. I was more looking to an answer which @jtacy provided in the comments. ... View more

we started getting the new logs from new log ingestion path and the internal logs from the server which stopped. we did not do anything and even the application team did not reboot the servers or restart the forwarder service. we did not get anything in splunkd logs as well. ... View more

Thanks for the response. Yes, we just changed the license to free. this helped our confusion. ... View more

I know nothing about the app. It's better if you post a new question about the problem you are facing. If this answers your first question please accept it to close this question. ... View more

Please add your outputs.conf to this post. cheers, MuS ... View more

yes, I am getting the metric log. Today i got the information from the Application owner is that there is no data in those servers in the log path they provided me as they are brand new servers. I think everything should be good once there are some logs in that path. Thanks for the reply. ... View more

we opened a case with splunk support and they cleaned the indexes which are no configured properly and did a rolling restart. After that everything was ok. ... View more

@sravankaripe here is the output of it.. [root@application-server bin]# netstat -anp --tcp | grep LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2896/sshd tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN 9043/splunkd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 3098/master tcp 0 0 0.0.0.0:8191 0.0.0.0:* LISTEN 9106/mongod tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 9043/splunkd tcp 0 0 127.0.0.1:8065 0.0.0.0:* LISTEN 9194/python tcp6 0 0 :::22 :::* LISTEN 2896/sshd tcp6 0 0 ::1:25 :::* LISTEN 3098/master ... View more

@sathwikr076 to be able to resolve this issue - will be better to send a support ticket to support@outcoldsolutions.com The reason for this error is that HEC does not have access to write to this index, or this index does not exist on Splunk. Depending on the version of Collectord you are using, you can configure incorrect index behavior with the configuration, see https://www.outcoldsolutions.com/docs/monitoring-kubernetes/v5/splunk-output/#http-event-collector-incorrect-index-behavior ... View more

I think you may be confusing the container/image OS with the platform OS. The platform OS would be the server on which you are running Docker, while the container/image OS is the OS that actually runs inside the container. Splunk supports running Docker on any (or most) versions of Linux with a Kernel version > 4.0 according to the documentation. But, the officially published Splunk Docker image is built on either Centos or Debian. You can build your own image using another flavor of Linux (CoreOS e.g.) but I do not believe that is officially supported by Splunk. https://github.com/splunk/docker-splunk/tree/develop/base ... View more

We have the same thing here. The regex itself seems working fine. It seems just another annoying error which could be safely ignore. I think the resolution is to write a less greedy regex. ... View more