I can see below status for the scheduled savedsearches. status="deferred" status="continued" What is the difference between the two and which one will get skipped later on(status="skipped") Are there any "failed" status as well? ... View more

We have multiple docker containers and there are some logs (created by our application, same log gets updated) inside those containers. We want to monitor those logs every 5 mins using Splunk UF which is outside the container. Splunk UF will send data to Splunk indexer in another server. Can you please tell me options to do this.   ... View more

Hi @trashyroadz  Have opened a new thread for the issue I am facing. Current Splunk version - 8.2.3.3 While running a query in search page, getting error as "Unable to distribute to peer named <idx name> at uri <splunk idx uri> because replication was unsuccessful. ReplicationStatus: Failed-Failure info: failed_because_BUNDLE_SIZE_RETRIEVAL_FAILURE". Verify connectivity to the search peer, that the search peer is up, and that an adequate level of system resources are available. Did not think of connectivity issue as in the message box got message saying bundle size exceeds limit. On checking, could see all apps in $SPLUNK_HOME/var/run/splunk/deploy in deployer even if we had changed a single file in a single app. As per my understanding only modified apps should be pushed to SHs and from SH captain to search peers. Please help on this. Let me know if any other detail is needed. ... View more

We are trying to ingest data from csv files. We have a monitoring stanza in inputs.conf which monitors all csv in a folder. Copied one file to that folder and data got ingested. After that tried copying new files to that folder but it stopped ingesting. New file is quite different than previous one. Have also tried different index/props, but same issue New files added to the directory are not getting ingested until you restart Splunk. Below is the monitoring stanza and props that we used. The inputs and props are in Heavy Forwarder and it is sending data to indexer cluster.      [monitor:///f1/f2/f3/*.csv] disabled = 0 index = test_input sourcetype = test initCrcLength = 2048 _TCP_ROUTING = test_indexer crcSalt =<SOURCE>     Below is the props.     [test] INDEXED_EXTRACTIONS = csv CHECK_FOR_HEADER = true HEADER_FIELD_LINE_NUMBER = 1 TIMESTAMP_FIELDS = mytime TIME_FORMAT = %Y-%m-%d %H:%M:%S FIELD_DELIMITER = , KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true       ... View more

Is it possible to revert the KV store storage engine migration in a standalone environment with SE 8.x.  Example: If I am migrating the KV store storage engine from MMAP to WiredTiger. Can I revert this change i.e. migrate from WireTiger to MMAP.   If it is possible what are the steps to do so. Is there any doc for this? I can see doc/command for migrating from MMAP to WiredTiger  splunk migrate kvstore-storage-engine --target-engine wiredTiger Need similar steps for the reverse condition. Please help. ... View more

I have multiple concurrent saved searches(around 6). All searches have outputlookup command which is writing to separate kvstore. Searches are taking too much time to execute the outputlookup command. It is working fine if outputlookup is removed. Any suggestion on this? I know there is limit on number of rows to written for the outputlookup command. But, as all searches are within that limit wondering if there is limit on number of concurrent outputlookup command. Is there any such thing? Is it like one search outputlookup will wait for other output lookup to complete? If so, any solution for that? ... View more

Searches starting to take more time to execute and then getting deferred at 9:10 am everyday. Number of searches are same throughout the day. No extra searches running around that time. ... View more

Hi, I have a script that is printing output of "/proc/loadavg". The script is running fine when executed manually. But data is not getting indexed in GCP instance. It is working fine in AWS instance. Both AWS and GCP instances have same configuration. There is no error in _internal index. Need suggestion asap. ... View more

I have configured my inputs.conf as mentioned below. [perfmon://Host Memory Swap] _TCP_ROUTING = my_indexer counters = % Usage disabled = 0 instances = _Total interval = 15 object = Paging File index = my_index showZeroValue = 1 But data is not getting indexed. Perfmon is working fine in the UF server(Windows 2008R2 64bit). The UF server is set to German language. Can the cause of the issue is the German Language? Splunk version is 7.1.4 Please suggest. ... View more