I tried to upgrade Python for Scientific Computing to v5.3 on my cluster.  I followed the instructions in here and first un-tar the add-on on my master node. However, whenever I ran /opt/splunk/bin/splunk apply shcluster-bundle, I will always get this error. Error while deploying apps to first member, aborting apps deployment to all members: Error while updating app=Splunk_SA_Scientific_Python_linux_x86_64 on target=https://172.18.109.2:8089: Network-layer error: Broken pipe This kind of error didn't happen when I installed another smaller add-on earlier this morning.  And after failing with that error multiple times, I noticed the doc says: If you attempt to push a very large tarball (>200 MB), the operation might fail due to various timeouts. Delete some of the contents from the tarball's app, if possible, and try again. Since the original python-for-scientific-computing-for-linux-64-bit_300.tgz is already 480MB, and the size of the un-tar and  unzipped /opt/splunk/etc/shcluster/apps/Splunk_SA_Scientific_Python_linux_x86_64 folder on the master node is 2.5G!  I bet the large tarball size is the problem. But how can I solve this problem?  What contents from the tarball's app can I delete? ... View more

I am trying to set up HEC for my indexer cluster (v8.0.7), with 2 indexers (and 3 search heads) managed by a master node. I read multiple docs and articles already, but I want to make sure I get some basic ideas correct first. In a non-clustered env, it's simple and each HEC client will talk to port 8088 of one indexer.  But in an indexer cluster environment: Which server will an HEC client talk to?  How can "load balancing of indexing" be achieved? Is the master node in any way involved? ... View more

I have a search SID, and currently I am getting its result using the API api/search/jobs/<sid>/results However, I also need to access the search query string behind this search result.  Is there an API for getting that? ... View more

In https://docs.splunk.com/Documentation/Splunk/8.0.7/Indexer/AboutSmartStore, there is a statement saying that "The home path and cold path of each index must point to the same partition." I am considering migrating some of the indexes in my clustered indexers to SmartStore.  However, most of my indexes have their home path on an SSD partition, with the cold path on a HDD partition.   With the statement above, does it mean that I cannot migrate them to SmartStore? ... View more

From here I know that there are two ways to update the MMDB, which is used by iplocation . https://www.splunk.com/en_us/blog/tips-and-tricks/updating-the-iplocation-db.html My MMDB file is updated monthly. My question is: do I need to restart my indexer after the file upgrade? Or is there a better way? ... View more

Below is the Bash script to change the ACL of a saved search: URL="https://splunksearch3.shatin.link:8089/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/acl" NEW_OWNER="user1" READ="batch,teamA" WRITE="teamB" curl -k -u admin:$PWD $URL -d owner=$NEW_OWNER -d perms.read=$READ -d perms.write=$WRITE \ -d removable=1 -d sharing="global" I found that I cannot change the removable attribute. After running the script, the permissions and owner are set correctly, but not the removable, it remains 0, as shown in the response below. <?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> <feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title>savedsearch</title> <id>https://splunksearch3.shatin.link:8089/servicesNS/nobody/search_migration_app/saved/searches</id> <updated>2019-02-13T12:47:43+08:00</updated> <generator build="06d57c595b80" version="7.2.3"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/nobody/search_migration_app/saved/searches/_new" rel="create"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/_reload" rel="_reload"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/_acl" rel="_acl"/> <opensearch:totalResults>1</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> <entry> <title>discuss-user-vt-count</title> <id>https://splunksearch3.shatin.link:8089/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count</id> <updated>2019-02-13T12:47:43+08:00</updated> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count" rel="alternate"/> <author> <name>user1</name> </author> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count" rel="list"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/_reload" rel="_reload"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count" rel="edit"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/disable" rel="disable"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/dispatch" rel="dispatch"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/embed" rel="embed"/> <link href="/servicesNS/nobody/search_migration_app/saved/searches/discuss-user-vt-count/history" rel="history"/> <content type="text/xml"> <s:dict> <s:key name="eai:acl"> <s:dict> <s:key name="app">search_migration_app</s:key> <s:key name="can_change_perms">1</s:key> <s:key name="can_list">1</s:key> <s:key name="can_share_app">1</s:key> <s:key name="can_share_global">1</s:key> <s:key name="can_share_user">0</s:key> <s:key name="can_write">1</s:key> <s:key name="modifiable">1</s:key> <s:key name="owner">user1</s:key> <s:key name="perms"> <s:dict> <s:key name="read"> <s:list> <s:item>batch</s:item> <s:item>teamA</s:item> </s:list> </s:key> <s:key name="write"> <s:list> <s:item>teamB</s:item> </s:list> </s:key> </s:dict> </s:key> <s:key name="removable">0</s:key> <s:key name="sharing">global</s:key> </s:dict> </s:key> </s:dict> </content> </entry> </feed> How can I change the ACL's removable attribute thru RESTFUL API? I need to do that as it's part of a migration process. ... View more