Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sat94541
sat94541
Communicator
Member since:
06-16-2014
06-05-2020
Community Statistics
| Posts | 90 |
| Solutions | 0 |
| Karma Given | 20 |
| Karma Received | 76 |
| Member Since | 06-16-2014 |
Activity Feed
- Got Karma for ndex clustering question (troubleshooting sbux)..Missing={ default:1 }. 07-14-2020 04:45 PM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Got Karma for Search Head Cluster bundle push failed with error Network-layer error: Read Timeout. 06-05-2020 12:49 AM
- Got Karma for Search Head Cluster bundle push failed with error Network-layer error: Read Timeout. 06-05-2020 12:49 AM
- Got Karma for Search Head Cluster bundle push failed with error Network-layer error: Read Timeout. 06-05-2020 12:49 AM
- Got Karma for Search Head Cluster bundle push failed with error Network-layer error: Read Timeout. 06-05-2020 12:49 AM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Got Karma for Installed Universal Forwader 7.1 - splunk showing “No users exist. Please set up a user.”. 06-05-2020 12:49 AM
- Karma Re: Why does kvstore lookup record insert fail with error "An error occurred during the last operation ('createCollection', domain: '5', code: '10334')"? for rbal_splunk. 06-05-2020 12:48 AM
- Karma Re: When the hot bucket is created on clustered envioemnet. What steps are followed. for rbal_splunk. 06-05-2020 12:48 AM
- Karma Re: Indexer Cluster - Cluster peer is downloading cluster bundle relatively for rbal_splunk. 06-05-2020 12:48 AM
- Karma Re: Why is the Distributed Management Console stuck in Standalone Mode? for rbal_splunk. 06-05-2020 12:48 AM
- Karma Re: Index Cluster: How do I identify list of excess Buckets in Clustered environment? for rbal_splunk. 06-05-2020 12:48 AM
- Karma Re: Does the Splunk App for Windows Infrastructure support having separate Active Directory forests? for rbal_splunk. 06-05-2020 12:48 AM
- Got Karma for Search Head Cluster scheduled searches: What are these Status values in scheduler.log?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 8 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
07-08-2018
03:26 PM
8 Karma
We noticed for newly install splunk Universal forwarder 7.1 we are unable to connect as user admin, and splunk was showing error “No users exist. Please set up a user.”
... View more
06-25-2018
01:23 PM
We have an issue with quite a number of duplicate alerts, all but 1 are real time searches. One example there were 5 alerts at the exact same time from 5 of the 11 Search Head in the Search Head Cluster .
Any ideas?
... View more
- Tags:
- clustering
11-27-2017
10:51 AM
All of the indexers in our index cluster are becoming unstable due to a user search. Would like a resource to review our indexer configuration and make config change recommendations on how to limit the ability of a user search to consume all the available memory on an indexer. Uploading diag from one of the affected indexers.
Does Splunk has capability to set some sort of Out of Memory killer, where search gets terminated if memory beyond some threshold is used.
... View more
11-13-2017
10:09 AM
4 Karma
Issue: We are on Splunk version 6.6.3 and when we push the Search Head Cluster Bundle from the Deployer to Search Head Cluster Member it fails with error
Deployer's "splunk apply shcluster-bundle" output
{noformat}
[splunk662T]# ./bin/splunk apply shcluster-bundle -target "https://10.140.54.186:55821"
Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members.
Please refer to the documentation for the details. Do you wish to continue? [y/n]: y
Error while deploying apps to first member: Error while updating app=unix on target=https://10.140.54.187:55821: Network-layer error: Read Timeout
... View more
07-31-2017
04:40 PM
What happen is we were changining index cold volume..The change the size of warm db and force bucket to roll to cold
The buckets roll to cold and now they we can't search the old data.
The buckets are in cold db and also can be search by running the search on the search peers
and the bucket is showed the flag is in frozen. How to remove the frozen flag
... View more
06-05-2017
03:22 PM
Does splunk say that ..... if your CM is down....we can survive any additional failures
... View more
06-05-2017
03:22 PM
Until one of them fails as well, in which case.....?
The cluster cannot remain healthy until the CM comes back up...?
... View more
06-05-2017
03:22 PM
Until one of them fails as well, in which case.....?
The cluster cannot remain healthy until the CM comes back up...?
... View more
06-05-2017
03:21 PM
so with RF 3, it's going to be the same two indexers over and over
... View more
06-05-2017
03:20 PM
we've believe that if the CM is down, we don't have to really break our necks in bringing it back up, e.g. an hour or more will be OK; in this instance, does the indexer always use the same peers to replicate to, or does it have a list of them it can use?
... View more
06-05-2017
03:19 PM
When the hot bucket is created on clustered envioemnet. What steps are followed.
... View more
04-04-2017
03:08 PM
1 Karma
One of our indexer cluster crashes and CM is showing many messages like
Missing enough suitable candidates to create replicated copy in order to meet replication policy. Missing={ default:1 }
What does this message mean...
... View more
03-28-2017
02:41 PM
Issue: Cluster Master with multi-site, by mistake wrong retention file was replicated and for the entire indexer in site1 Data got deleted.
Now only peer in site2 has data.As soon as we realized this mistake we have shut down the splunk instance.
What steps can we take to save as much as data possible.
... View more
03-13-2017
10:18 AM
this resolve the issue
... View more
03-13-2017
10:15 AM
When user try to update kvstore using command like
| inputlookup [backupdata] | output
This errors out with error below
Error :
Could not write to collection [kvstore] error occurred during the last operation ('createCollection', domain: '5', code: '10334'): exception: BSONObj size: 1751347969 (0x68637301) is invalid. Size must be between 0 and 16793600(16MB) First element: d_time: ?type=101.
Preliminary research indicates this could be a database related error.
3-08-2017 08:39:21.322 ERROR KVStorageProvider - An error occurred during the last operation ('createCollection', domain: '5', code: '10334'): exception: BSONObj size: 1751347969 (0x68637301) is invalid. Size must be between 0 and 16793600(16MB) First element: d_time: ?type=101
03-08-2017 08:39:21.322 ERROR outputcsv - sid:1488991161.995 Could not write to collection 'vulnerability_management': An error occurred during the last operation ('createCollection', domain: '5', code: '10334'): exception: BSONObj size: 1751347969 (0x68637301) is invalid. Size must be between 0 and 16793600(16MB) First element: d_time: ?type=101.
... View more
- Tags:
- inputlookup
- kvstore
01-17-2017
09:49 AM
I have Cluster Master with 2 Indexers. These are on version 6.3.5
We noticed that on one of the indexers and for an index “winevent”, we hit the following errors:
1-11-2017 09:31:54.947 -0500 ERROR TcpInputProc - event=replicationData status=failed err="Could not open file for bid= winevent ~127~051261C5-3A44-451D-B5EA-48DEC971466A err="Cannot find config for idx=ads_main" (The operation completed successfully.)"
1-11-2017 08:25:25.289 -0500 WARN IndexerService - Received event for unconfigured/disabled/deleted index= winevent with source="source::WinEventLog:Security" host="host::SDRT0086" sourcetype="sourcetype::WinEventLog:Security". So far received events from 1 missing index(es).
01-11-2017 08:22:20.879 -0500 ERROR DatabaseDirectoryManager - idx= winevent bucket=db_1483621671_1483545612_420_051261C5-3A44-451D-B5EA-48DEC971466A Detected directory manually copied into its database, causing id conflicts [path1='\\gofisilon01.nac.ppg.com\Archive\Splunk\Idx2\ winevent \colddb\rb_1483621671_1483545612_420_051261C5-3A44-451D-B5EA-48DEC971466A' path2='\\gofisilon01.nac.ppg.com\Archive\Splunk\Idx2\ winevent \colddb\db_1483621671_1483545612_420_051261C5-3A44-451D-B5EA-48DEC971466A'].
Due to these duplicate buckets the index “winevent” got marked as “Disabled? What can be done for this issue?
... View more
12-21-2016
10:00 AM
I have Splunk Version 6.3.3 and it has two Sites. Site1 has two indexers and Site 2 has two indexers.
For maintenance purpose they shutdown peers in Site 2 and found that after that the indexer stopped indexing.
Many things were attempted to resolve the issue like restarting Cluster master and Cluster peers, but the issue didn’t resolve
... View more
12-20-2016
06:03 PM
There are several TTL (Time To Live). Can you tell us what the difference is between these and do these refer to the time the search has to live/execute or the search results?
· defaultSaveTTL
· defaultTTL
· eai:acl.ttl
· ttl
... View more
09-08-2016
04:16 PM
1 Karma
Can you please help us in letting know calculation on how our search concurrency limit is being hit in my Search Head Cluster Deployment? We will like to investigate when we see a Schedules search being skipped.
... View more
09-08-2016
01:37 PM
4 Karma
Looking at scheduler.log from a search head cluster member, the scheduler.log has a status column that can have following values:
delegated_remote
delegated_remote_completion
delegarte_remote_error
skipped
success
It will be useful to get information about each of these values in context of Search Head Clustering.
index=case_356897 host=* sourcetype=*sched* source="*scheduler.log" | timechart span=6month count by status
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
