×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
mandarpimplapur
Explorer
Member since: ‎07-04-2016
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎07-04-2016
Activity Feed
View All

Re: Why is universal forwarder connection failing ...

by in Getting Data In
‎04-04-2017 03:02 AM
‎04-04-2017 03:02 AM
This port need to be enabled from Splunk Master UI : Manager --> Forwarding and receiving --> Receive Data --> Add a new entry for Port 9997 or any. Bounce the service once to changes affect. ... View more

Re: Archival on Indexer

by in Getting Data In
‎08-17-2016 06:01 AM
‎08-17-2016 06:01 AM
Thanks for you inputs, Also I have some other query: Configurations: maxDataSize = auto_high_volume maxHotSpanSecs = 90 days maxTotalDataSizeMB = 1.5 TB frozenTimePeriodInSecs = 1 Yrs Space taken by the buckets = (maxWarmDBCount + maxHotBuckets ) * maxDataSize =(300 + 10 )*10GB = 3100GB for auto_high_volume Space taken by the cold buckets = maxTotalDataSizeMB - "size of the hot+warm buckets" = 1100GB - 3100GB = - 2000GB for auto_high_volume (There is no cold bucket exists) The current main index size is 1.1TB and keep increasing with having warm buckets of 12GB size each. The main index contains data from last 5 years. How we can purge these data from main indexer, also the maxDataSize is set to 10GB then why the buckets are created with 12GB data ? Can someone kindly provide the correct archival policy as well as the setting for the indexers as well buckets. ... View more

Archival on Indexer

by in Getting Data In
‎08-12-2016 12:01 AM
‎08-12-2016 12:01 AM
I have a setup running of Splink 5.x with default config as shown below: maxDataSize = auto_high_volume (i.e. 10GB) maxHotSpanSecs = 7776000 ( 90 Days) maxTotalDataSizeMB = 500000 (i.e. 500 GB) frozenTimePeriodInSecs = 31104000 (i.e. 1Yrs default is 6Yrs) Also having number of Indexers like audit, internal, history, summary and main indexer. Out of which main indexer having index size 1.09 TB and continuously increasing. So, how can we archived the main indexer using the above parameters, can we controlled over it. ... View more

Distributed Deployment

by in Deployment Architecture
‎07-04-2016 05:47 AM
‎07-04-2016 05:47 AM
Dear Team, We have a splunk 5.x version setup in our Office Environment as follows: Splunk Server with "N" number of Forwarders. Now, we need to add one new box with search heads and the splunk servers will act as Indexers. Will it be possible ? Am i on right track. Thanks in advance. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All