Hi all, Need in some issue which is might be a known one, please help. every frequently one or the other indexer(splunkd) service is going in "defunct" state then when i try to restart the service all PID's related to splunk going in state so cannot restart the service aswell. Initially, it was showing below "defunct" then i tried to restart splunk.service [root@hostname ~]# ps -ef | grep defunct root 23399 23167 0 21:49 pts/1 00:00:00 grep --color=auto defunct svc.spl+ 32079 4383 0 09:07 ? 00:00:03 [splunkd] [root@hostname ~]# I tried to restart and the status is below. [root@hostname ~]# systemctl status splunk.service ● splunk.service - Splunk Loaded: loaded (/usr/lib/systemd/system/splunk.service; enabled; vendor preset: disabled) Active: activating (start) since Sun 2020-02-02 22:45:54 MST; 1min 9s ago Process: 29434 ExecStop=/opt/splunk/bin/splunk stop (code=killed, signal=TERM) Main PID: 4381; : 32121 (splunk) CGroup: /system.slice/splunk.service └─32121 /opt/splunk/bin/splunk start --answer-yes --no-prompt --accept-license ‣ 4381 [splunkd] Feb 02 22:45:54 hostnme.domain.com systemd[1]: Starting Splunk... Feb 02 22:45:54 hostnme.domain.com splunk[32121]: splunkd 4381 was not running. Feb 02 22:45:54 hostnme.domain.com splunk[32121]: Stopping splunk helpers... [root@hostname ~]# ps -ef | grep splunk svc.spl+ 4381 1 99 Jan30 ? 5-12:21:04 [splunkd] svc.spl+ 7638 1 0 09:05 ? 00:00:37 [splunkd] svc.spl+ 7639 7638 0 09:05 ? 00:00:00 [splunkd] svc.spl+ 26167 1 0 09:06 ? 00:00:14 [splunkd] svc.spl+ 26168 26167 0 09:06 ? 00:00:00 [splunkd] svc.spl+ 32079 1 0 09:07 ? 00:00:03 [splunkd] svc.spl+ 32080 32079 0 09:07 ? 00:00:00 [splunkd] svc.spl+ 32121 1 0 22:45 ? 00:00:00 /opt/splunk/bin/splunk start --answer-yes --no-prompt --accept-license root 32281 23128 0 22:47 pts/1 00:00:00 grep --color=auto splunk svc.spl+ 36590 1 0 09:08 ? 00:00:03 [splunkd] svc.spl+ 36597 36590 0 09:08 ? 00:00:00 [splunkd] svc.spl+ 36744 1 0 09:08 ? 00:00:08 [splunkd] svc.spl+ 36746 36744 0 09:08 ? 00:00:00 [splunkd] svc.spl+ 45222 1 0 09:10 ? 00:00:01 [splunkd] svc.spl+ 45224 45222 0 09:10 ? 00:00:00 [splunkd] any help would be appreciated. Thankyou. ... View more

Hey all, I need an eval expression for the below output: _time minutes bminutes 2019-06-01 1349511.54 105472800 2019-06-08 1498691.33 105472800 2019-06-15 1447368.29 105472800 2019-06-22 1379824.64 105472800 It is by every week so I need an eval expression from which I can divide every row of minutes by bminutes by time. Expected results: _time minutes bminutes result 2019-06-01 1349511.54 105472800 1.279 2019-06-08 1498691.33 105472800 1.420 2019-06-15 1447368.29 105472800 1.372 2019-06-22 1379824.64 105472800 1.308 ... View more

I have data indexinng from January and have a query trying to run for last 6 months or more than 6 months, but search results events only till march(last 3 months). how to increase search events limit ? I dont want to force query using "earliest=-6mon@mon" "latest=@mon", instead is there any other way ? as i need to save that as a report and use loadjob using timepicker in a dashboard. so cannot use earliest and latest in search itself. ... View more

hi all, I basically have a very large query with many of evals, stats, streamstats and lookup is also used. which gives the utilization and average utilization for all call records from CDR with total 6 fields. so wanted to run this query for last 12 months and saved that as a report and scheduled for every month on 2nd(to manage TZ related differences). I even saved this report in a dashboard. here I have 2 question. 1.when ever i open dashboard looks like again the DB is running for last 12 months because it takes too much time to load the results in panels? note:- my aim was to add a panel using reports and juss display that cached report in dashboard. 2.after we save the report by taking time range picker(yes) and if I wanted to look for the data only for last 3rd month from that 12 months of data, will it sort out to show that results in dashboard from that cached report? ... View more