Hello, is there any update on how to resolve this error?  On version 9.0.4 and still experiencing the same.  Thank you. ... View more

Even this is old case, I would like to add which the one can do with current versions. Just run this: | dbinspect index=* OR index=_* corruptonly=true | search state!=hot Select enough long time period to found all corrupted buckets. r. Ismo  ... View more

Thanks for the quick response Michael. I'll work with our partner to get them started on using our existing HTTP Event Collectors. cheers, -Jim O. ... View more

Yes, that is what I was planning to do -- have the forwarder install script set the required value in SPLUNK_HOME/etc/system/local/inputs.conf via an input parameter on the install script. ... View more

Well that is certainly a simple fix. I appreciate you following up for others that may run into this as well. ... View more

I had a similar situation recently where this happen. Support suggested the answer above, but it was unfortunately too late as I had already removed core splunk. Some time passed and was at a point where I needed to bounce the splunkd service. After the service came back online I noticed that the SH was removed from the Search Heads Tab of the Indexer Clustering page. ... View more

Thanks Burch. ... View more

If you utilise a new deployment server the app checksum's that is provided to the client will differ. As such the client will remove the old app(s) and install the new one(s). This is why you need to use "sticky sessions" if you load balance deployment servers. Each deployment servers checksums are unique even if they contan that EXACT same (ie. md5sum shows exactly the same) files. If you replace one deployment server for another this same behaviour will occur also. The delay in replacing the app will be the phonehome time. This is also based on the initial start time of the instance. ... View more

When I've had this issue, I chalked it up to entropy on the system over time. Assuming the config and the ports are all good, then I start with some simple and basic things: Run splunk stop and then do a kill -9 on the results of: ps -ef | grep -i splunk | grep -v grep | awk '{print $2;}' to stop anything that didn't actually shut down Restart the actual server thereby purging any zombie processes that might not be needed but are still running from usage over time When all else fails, reinstall that instance. This can be made easy through proper use of the configuration distribution features ... View more

As long as the load/job of Deployment Server & cluster Master instance is less, its fine to have all in 3 in one. Offcourse having them in separate instances better incase if there's going to be more Forwarders or Indexers planned for near future which will increase the load on Deployment Server and Cluster Master. ... View more

Thank you. It works now. I was not using the listening port, but rather the HTTP port in my outputs.conf. cheers. ... View more

Does this not make sense to you? That is exactly how I would have designed it: the user that is running the Splunk instance (which is usually either splunk or root ) is the one that will own all of the KOs from a host-OS perspective. The GUI will allow any user who is logged in to edit his own stuff from the GUI. You can do the SAME THING with the Splunk CLI but you have to use the splunk CLI command to do it (i.e. $SPLUNK_HOME/bin/splunk add ...). As you have found, you cannot use the host OS CLI to do it by using a regular editor. ... View more

I have the same question and would like further instruction. How can I set up multiple search indexes? I need one for mail with a retention of four months for example and another index for proxy logs, etc. How do I set up the indexes to the specific source? Thanks ... View more

done. http://splunk-base.splunk.com/answers/35354/totally-redundant-2-node-cluster ... View more