About zdrazil

zdrazil · ‎10-16-2020

The lookup is updated by saved search. Its name is "UpdateFullHierarchyAndEntity " and it is stored in app "SA-VMW-HierarchyInventory". You can run it manually to fill up the lookup and than you can change schedule. Its schedule is */15 * * * *. It means it will be run every 15minutes (XX:00, XX:15,XX:30,XX:45). These minutes are usually busy minutes and the saved search could be skipped. I think that better shedule will by something like 2-47/15 * * * * (XX:02, XX:17,XX:32,XX:47).

zdrazil · ‎07-22-2019

I've solved it. 🙂 It is not right solution. I've reinstalled Splunk and ES. The error is gone.

zdrazil · ‎07-22-2019

I've checked kvstore status by command: ./splunk show kvstore-status Status is ready. I am not sure how to check health of kvstore. You mean Monitoring console/Health check?

zdrazil · ‎07-11-2019

I am getting below error message. 2019-07-11 09:36:25,643+0000 ERROR pid=18084 tid=MainThread file=configuration_check.py:run:228 | status="completed" task="confcheck_es_sync_investigation_xrefs" message="Failed to sync xref collection and investigations: Could not get investigation notable xrefs" I have single-instance environment with fresh installation of Splunk Enterprise 7.2.7 and ES 5.3.0. I excluded all add-on during ES installation. Can you please explain why this error message is coming and is there any impact on Splunk or ES? thanks in advance for your reply Michal

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-11-2019

Online Status	Offline
Date Last Visited	‎10-16-2020 11:03 AM

Error message Failed to sync collection and invest...

Re: Getting this error on my Splunk for VMware "Lo...

Re: Error message Failed to sync collection and in...

Re: Error message Failed to sync collection and in...

Error message Failed to sync collection and invest...