is ended up solving a major problem for me using Ansible to setup Splunk and running python scripts inside the Ansible playbook. Thank you so much! ... View more

I had the same problem and followed the instructions here and it helped me get Eventgen up and running. I love this tool! In short, I downloaded httplib2 2.0.8, unpacked it, then ran the $ python setup.py install command from that directory. ... View more

Try something like this Your base search giving fields 'Time' and 'rate' | sort Time | streamstats current=f window=1 first(rate) as prevRate | sort -Time | eval baselineRate=round((rate-prevRate)/60,2) ... View more

I am looking at a similar problem. What I have observed is that when the heavy forwarder is unable to deliver to the upstream indexers ( Splunk Cloud in my case) due to network congestion, indexer unavailability, or network outage, then the heavy forwarder will refuse downstream connections, causing these errors. Once the buffer is full, it refuses any further connections. I think it is designed that way to force loadbalancing. Normally this is transient, as per your logs. In my case if the heavy forwarder goes into rejecting mode, it does not recover until it is restarted. ... View more

yeah,i can see it,but it is not work. [root@localhost lookups]# ls switch_info.csv switch_name.csv wan.csv [root@localhost lookups]# vim switch_info.csv host,name,int,ip 10.3.15.11_TenGigabitEthernet5-4,A,Ten5-4,10.3.15.11 10.3.15.11_TenGigabitEthernet6-4,A,Ten6-4,10.3.15.11 10.3.15.12_TenGigabitEthernet5-4,B,Ten5-4,10.3.15.12 10.3.15.12_TenGigabitEthernet6-4,B,Ten6-4,10.3.15.12 I tried many methods, can not, I am depressed ah. ... View more

Have to find a solution. ... View more

thanks jtrucks ... View more

Thank you jtrucks ! because we require data accuracy and high safety, all I want to know Splunk high availability is how to achieve, what is the internal mechanism, how in the optimal conditions, the realization of these? ... View more