About splunkapprentic

splunkapprentic · ‎10-18-2023

Do you have a reverse proxy mapping (RPM) on top of the SearchHead node? Might be an error related to the configuration of this RPM.

splunkapprentic · ‎11-08-2019

It looks like this is now possible with the new Splunk version 8.0 source: https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Sharedatamodelsummaries

splunkapprentic · ‎08-29-2018

I have the same problem with an old linux box. have you managed to fix it somehow?

splunkapprentic · ‎08-23-2018

If you have this problem on a SH node, you can use the official Fix Raft issues on a member: To fix a Raft issue, clean the member's _raft folder. Run the splunk clean raft command on the member: Stop the member: splunk stop Clean the member's raft folder: splunk clean raft Start the member: splunk start The _raft folder will be repopulated from the captain this is described in the documentation: https://docs.splunk.com/Documentation/Splunk/7.1.2/DistSearch/Handleraftissues

splunkapprentic · ‎08-17-2018

If you are using a proxy connection make sure that it's working and you've white-listed the Azure domains as the initial http request is done on login.microsoftonline.com but is just a redirect to www.office.com/login Here are some domains to consider to white-list in your proxy server: https://microsoft.com/ https://windows.net/ https://office.com/ https://microsoftonline.com/ https://azure.com/

splunkapprentic · ‎04-04-2018

yes, the funny fact is I can't find any Config: Topology Data Generator saved search

splunkapprentic · ‎04-03-2018

Hi Splunkers, how can I debug why I don't have the instances in AWS Topology? is any relation with the topology layers like CPU Utilization and Network Traffic with the Instances, although the reports are populating correctly the CSVs. I have the latest version of aws and aws add-on deployed on my instances. thanks.

splunkapprentic · ‎09-21-2016

yeah! the last one seems to do the job 😉

splunkapprentic · ‎09-21-2016

I don't think I have the _time records 😞

splunkapprentic · ‎09-21-2016

Hello, please help! I want to display only the unique names from yesterday that are not in today's list Initial search: Date Name Value 09/18/2016 ABC 2 09/18/2016 XYZ 9 09/18/2016 EFG 8 09/19/2016 ABC 3 Final search: Date Name Value 09/18/2016 XYZ 9 09/18/2016 EFG 8

Posts	10
Solutions	1
Karma Given	7
Karma Received	2
Member Since	‎09-21-2016

Online Status	Offline
Date Last Visited	‎10-18-2023 10:11 AM

Why are the Splunk AWS instances are not showing u...

show unique values from yesterday

Re: ES Error: Cannot read properties of undefined ...

Re: Is there a way to share a Data Model across 2 ...

Re: RHEL 5.x support

Re: After a RAID failure, why won't our search hea...

Re: Microsoft Cloud Service Add on - Not able to o...

Re: Why are the Splunk AWS instances are not showi...

Why are the Splunk AWS instances are not showing u...

Re: show unique values from yesterday

Re: show unique values from yesterday

show unique values from yesterday