We have a user who has created a large csv lookup file (600 Mb). It seems that this file is being replicated to every Yarn server to it's /tmp directory (/tmp/splunk/nodename/splunk/var/run/searchpeers) apparently as every search is executed. There are multiple copies of this bundle. This is filling the /tmp directory and causing a major problem, it also slows every search as this file has to be copied before the search begins to execute. We have specified the following in the hunk servers distsearch.conf to no effect: [replicationBlacklist] Everything = Servers.csv How do we block this file being copied with every search? Can the file be moved into an HDFS directory instead? Can it be cached so that it doesn't need to be replicated with every search? ... View more

For example, I have a user (test_user) that is a member of these two roles: [role_role_a] importRoles = user srchIndexesAllowed = _audit;_internal srchIndexesDefault = _audit;_internal srchMaxTime = 0 [role_role_b] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = user srchDiskQuota = 130 srchFilter = (ConfigVersionId=86 (Address=*)) srchIndexesDefault = iselogs srchMaxTime = 0 This works well, and when this user runs the search, the srchFilter from role_b appears to work: litsearch ( index=* ) ( ( ( ConfigVersionId=86 ( Address=* ) ) ) ) However, what I would like is only to have the srchFilter be applied to the indexes of role_b, but not role_a (ie. the filtering should not be applying to both _audit and _internal indexes). I have tried setting srchFilter = * in role_a: [role_role_a] importRoles = user srchFilter = * srchIndexesAllowed = _audit;_internal srchIndexesDefault = _audit;_internal srchMaxTime = 0 But that seems to override the srchFilter for role_b. ... View more

According to the doc here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Setuploadbalancingd Important: Universal forwarders are not able to switch indexers when monitoring TCP network streams of data (including Syslog) unless an EOF is reached or an indexer goes down, at which point the forwarder will switch to the next indexer in the list. Because the universal forwarder does not parse the data and identify event boundaries before forwarding the data to the indexer (unlike a heavy forwarder), it has no way of knowing when it's safe to switch to the next indexer unless it receives an EOF. We would like to know what exactly is Splunk UF looking for to determine EOF? Additional info: Currently, our app sending to the UF's TCP port does not use an EOF marker. This causes the UF to send data to the same indexer since it cannot switch to another indexer. As a result, we set forceTimebasedAutoLB=true to force the UF to switch indexers. However, our tests show that the UF fails to send events when this is set. For example, the following configuration: autoLB = true autoLBFrequency = 5 forceTimebasedAutoLB = true results in approximately 80% event loss when sending events received via TCP port at a rate of 1 event per second. From our testing: autoLB=F forceTimebasedAutoLB=F -> okay autoLB=F forceTimebasedAutoLB=T -> dropped events autoLB=T forceTimebasedAutoLB=T -> dropped events autoLB=T forceTimebasedAutoLB=F -> okay ... View more

Hello Splunkers, I would like to seek advice on how to achieve the same goal without having to use the join command. This is the current search, with the use of the join command: index=myidx sourcetype=myapp_log status=startSecurityUpgrade earliest=-6h@h latest=now | eval Start_Time=strftime(_time, "%m/%d/%y %H:%M:%S") | join host_ip [search index=idms_sat sourcetype=myapp_log status=sendCode earliest=-6h@h latest=now | eval Enrolled_Time=strftime(_time, "%m/%d/%y %H:%M:%S") ] | where Enrolled_Time > Start_Time | timechart span=10m count(host_ip) The problem I have with the above search (join command) is that if the data set is large, the count would become inconsistent. ... View more

In the Archive dashboard, I see two panels for archiving via coldToFrozen by index, I've googled it and looked through the documentation, but don't see how to configured this for HDFS. Am I correct to assume that it's not for the HDFS or S3 archiving, but for the archiving scripts method? ... View more

When HUNK does its bucket pushes to HDFS, it also pushes a couple small supporting files, metadata, etc... With Hadoop's issues handling small files, I was wondering if that is something that's been looked at or not? For using the HUNK archiving on clustered indexers, I understand that if the buckets have 2 or greater searchable copies of the data, searches against that archived data will return duplicated results, is that correct? ... View more