Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About nawazns5038
nawazns5038
Builder
Member since:
11-25-2016
09-20-2021
Community Statistics
| Posts | 225 |
| Solutions | 6 |
| Karma Given | 17 |
| Karma Received | 20 |
| Member Since | 11-25-2016 |
Activity Feed
- Got Karma for Re: new indexer not showing in Monitoring console. 10-02-2023 08:12 PM
- Got Karma for Changing the Ulimits for openfiles. 12-13-2022 06:45 AM
- Got Karma for Why is Distributed Management Console (DMC) not displaying accurate DISK usage values?. 01-05-2022 12:42 AM
- Got Karma for Re: Knowledge Objects with "No owner" ownership.. 12-27-2021 07:55 AM
- Got Karma for Knowledge Objects with "No owner" ownership.. 12-27-2021 07:55 AM
- Posted Re: Automatic client deletion in deployment server (similar to manual "delete record" option). on Deployment Architecture. 09-20-2021 04:17 PM
- Posted Re: Splunk rest curl query fails to execute on the successive attempts with the session key authorization on Splunk Search. 07-29-2021 05:08 PM
- Karma Splunk rest curl query fails to execute on the successive attempts with the session key authorization for sathishraja92. 07-29-2021 05:08 PM
- Got Karma for Double field extraction for the JSON data. 04-02-2021 06:48 AM
- Posted Re: Splunk Cloud Gateway setup on All Apps and Add-ons. 10-06-2020 11:27 AM
- Posted Re: Splunk Cloud Gateway setup on All Apps and Add-ons. 10-06-2020 11:07 AM
- Posted Re: Problem with upgrade on Splunk Cloud Gateway to version 1.12.4 - drone_mode_subscription_modular_input on All Apps and Add-ons. 10-04-2020 04:23 PM
- Posted Re: Splunk Cloud Gateway setup on All Apps and Add-ons. 10-04-2020 04:23 PM
- Posted Re: .csv file input indexed and available in splunk but the data is invisible on Getting Data In. 09-16-2020 05:02 PM
- Posted Re: Data PArsing json on Getting Data In. 08-27-2020 03:48 PM
- Karma Re: Data PArsing json for to4kawa. 08-27-2020 12:34 PM
- Posted Re: Data PArsing json on Getting Data In. 08-27-2020 12:32 PM
- Posted Re: Data PArsing json on Getting Data In. 08-26-2020 10:11 AM
- Posted Data PArsing json on Getting Data In. 08-25-2020 04:29 PM
- Posted field extractions transforms on Getting Data In. 07-16-2020 11:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
01-26-2019
04:26 PM
how about reboot after that. yum upgrade requires a reboot for sure in order to take effect of full updates.
Can we reboot multiple Splunk indexers at least at once or should it only be individual ?
... View more
01-23-2019
06:30 PM
can we offline two to three splunk instances and upgrade the OS at once ??
Or is it mandatory to offline only one instance at a time ??
... View more
01-23-2019
12:51 PM
Hi ,
I wish to patch the Linux OS for all the Splunk servers (including search heads, indexers etc). There are a lot of instances.
IS there any specific procedure to be followed or just have to be patched one by one.
Splunk version 6.5.3
Thanks
... View more
01-23-2019
12:20 PM
1 Karma
Ya, can be seen in through the command
/opt/splunk/bin/splunk envvars
... View more
01-21-2019
02:33 PM
no errors for now. Just curious as I don't see the output of echo $SPLUNK_HOME as well.
... View more
01-18-2019
05:42 PM
how to check which certificate is being by server.conf .
I have updated the certificate in the back end but still showing the old one.
... View more
01-18-2019
05:34 PM
I observed is that $SPLUNK_HOME is not set on the splunk-launch.conf file on the search heads . Is that a problem ??
... View more
01-18-2019
05:32 PM
Hi,
The search head cluster uses our own certificates which are going to expire soon. So in order to update the certificates I have pushed the certs through the deployer and updated the SSL Password in server.conf and outputs.conf and the search heads restarted and everything is working fine without errors . But the certificates have not been updated. UI still shows the old certificate and I have checked the expiry through CLI as well. It shows the old certificate. The new certificates have been pushed in the backend.
What could be the reason ?? Anything that I have missed ?
I have double checked using btool , and the certs are pointing towards the right direction .
One thing I observed is that $SPLUNK_HOME is not set on the splunk-launch.conf file . Is that a problem ??
... View more
01-18-2019
02:37 PM
I have posted the steps involved. you can accept it or make it +1 so that others would take help of it.
... View more
01-18-2019
02:35 PM
Problem was solved by relocating the KVstore to a different location.
This isn’t something you can push out via the deployer because the kvstore files must be manually moved. If you can deal with a few minutes of downtime on the SH I would recommend the following:
1) Stop all of the search heads.
2) Move the kvstore directory to a new volume.
3) Modify the server.conf file to point to the new location.
4) Start all of the search heads.
... View more
01-17-2019
02:12 PM
Hi,
Can we create a custom folder in /opt/splunk/etc/ directory. Will that affect any functionality of Splunk ?
Basically I want to a take a backup of an app and store it somewhere inside Splunk directory.
Thanks
... View more
01-17-2019
12:55 PM
you can create a sample app(a folder in shcluster/apps directory) with zero or uneffecting configs like app.conf and push the bundle
... View more
12-27-2018
12:22 PM
Hi,
I have a clustered environment and it runs smoothly, but sometimes, I see a spike in CPU Usage in some of the indexers up to 70 or 80%.
what would be the reason ?
For what purpose does a Splunk indexer use CPU and what is the ideal CPU usage in an indexer ?
Thanks
... View more
11-29-2018
04:16 PM
Hi,
I want to create a role and import capabilities or index permissions .
Suppose , I have role A which has indexes allowed = dog,cat
I create a role B and say importRoles = A and B has search indexes allowed = fish, chicken.
what index permissions does role B have in final ??
And also the capabilities ?
Will both the search indexes allowed get mixed ? or only the capabilities ??
Thanks,
... View more
11-27-2018
03:14 PM
how about linux ?
... View more
11-20-2018
01:19 PM
Hi,
I want to decommission a peer and remove it from the cluster.
Should keep the cluster in maintenance mode and run the following command
splunk offline --enforce-counts
Or,
Just run the above command as it is on the peer and remove it from the cluster ?
... View more
11-20-2018
12:28 PM
./splunk remove cluster-peers -peers 20B9E07D-A1F1-4E82-9D08-BC02893B3A8C
Did you perform the command from the cluster master ??
... View more
11-16-2018
12:59 PM
-bash-4.2$ /opt/splunk/bin/splunk restart
splunkd is not running. [FAILED]
But, I am getting the following error :
Splunk> Another one.
Checking prerequisites...
Checking http port [8443]: open
Checking mgmt port [8089]: already bound ERROR: The mgmt port
[8089] is already bound. Splunk needs
to use this port. Would you like to
change ports? [y/n]: n Exiting....
Please help !
... View more
11-13-2018
02:46 PM
What exactly does the setting do ?
... View more
10-29-2018
03:50 PM
I am not sure of that, but I am sure some of the dashboards contain deprecated XML, you can find some more help in the following link. But I don't think editing all the dashboards and make it compatible is a good idea.
https://answers.splunk.com/answers/693999/dashboard-not-loading-after-splunk-upgrade.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-20-2021
07:37 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
