About mgiddens

govardha · ‎01-15-2021

I have this problem too in 8.0.6 but no idea why it is happening.

richgalloway · ‎09-23-2019

I don't know enough about Windows user administration to answer.

mgiddens · ‎06-07-2019

Thanks for the response. Turn the "disabled" setting back to 0 for all search heads; logged into one to verify and saw the "search head clustering" option available again in the UI. Then tried to remove as you stated; no joy, still getting the KV errors. It seems like once you get it into search head clustering, its hard to completely break it down so its as though you never configured it at all; which is what I am aiming to do. Do I have to dis-engage the conf_deploy_fetch_uri (cluster deployer) too or any other conf file modifications on that server? Any other ideas? Thank you. mgiddens -Mike

mgiddens · ‎06-09-2019

Never posted the answer here. This issue was due to the fact I wasnt't forwarding my license master's internal logs to my index cluster. I configured "outputs.conf" file in "/opt/splunk/etc/system/local/outputs.conf" to forward from license master to index cluster. License usage started to reset at midnight again. Thanks for all the advice and hope someone would find this useful someday. mgiddens

woodcock · ‎05-05-2019

This is a HUGE questions and a completely different one that you asked in this link. Setting up SSL is a major pain in Splunk.

mgiddens · ‎04-18-2019

Yeah I wasn't sure which I should post as the final answer since collectively there many that offered assistance. So I figured I would just summarize the ultimate fix in a post and mark as answered; thought it might make it easier for anyone who experiences this in the future to find what exactly fixed my issue of all the inputs received. Can you accept multiple post as the answer? I didn't try.

ragedsparrow · ‎04-03-2019

Awesome! Glad I could help!

Posts	22
Solutions	2
Karma Given	0
Karma Received	1
Member Since	‎04-03-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

ES detected "Default Account at Rest" - How do you...

How to tear down a search head cluster?

License slave indexing data but showing "0%" licen...

Splunk daily license volume not resetting at midni...

Accidently deleted the shcluster/apps directories ...

Need some understanding of Splunk server roles?

Re: Why is license usage not resetting at midnight...

Re: ES detected "Default Account at Rest" - How do...

Re: How to tear down a search head cluster?

Re: License slave indexing data but showing "0%" l...

Re: Splunk daily license volume not resetting at m...

Re: Accidently deleted the shcluster/apps director...

Re: Need some understanding of Splunk server roles...

Join the Conversation