Hi All, I've ran a search and got these errors   I've checked the lookup and it's empty Is there a way to recover it? Thanks, Hen ... View more

There is no general consensus / best practice on what to use, it depends on what you want to find out. To choose the aggregation properly, you need to understand what it means. Actually, it is just pure maths. Splunk has fill ratio values on per minute basis (or maybe per every few seconds, I am not sure about that), however the graph presents them aggregated. That means several values in Splunk logs (all values in certain time window, that means per 5min, per 1h, per 1d, ...) are aggregated into one single value presented to user in graph. In another words, if you choose to display maximum, you will get the upper limit: you know the queue fill ratio did not exceed this value during the respective timeframe. It could be useful, let's say, to prove your hardware is such an overkill that your queues can never ever get full. To check you have no I/O trouble, average/median/90percentile are much more appropriate. ... View more

Brilliant. That's working, thank you for the suggestion! Note for anyone else who may have a Windows deployment server and a *nix UF - you'll have to check/change the file permissions / owner on the .sh file after deployment, ... View more

I am updating my answer to include commenting out the lines in inputs.conf. This bug will be fixed in version 6.0.1 ... View more

@rpquinlan did you ever get this figured out? I am also trying to do a multi-format search via dashboard and I got about as far as your last post. Thanks. ... View more

To answer your last question first: " what does opt and $SPLUNK_HOME has to do with each other? --$SPLUNK_HOME is used in documentation because that's a variable part of your install. You could have installed Splunk where you did (/opt/splunk), or you could have installed it elsewhere (like /opt/apps/splunk), so to keep things consistent, $SPLUNK_HOME is used to represent the directory path to where your installation of splunk is - in your case, /opt/splunk --It's a best practice to never change any of the files in the "default" directory (whether that's system/default, apps/xxx/default, or anything like that), as they can be overwritten with every upgrade. In your case, you're on the right track - copy your /opt/splunk/etc/system/default/web.conf (or as it's said, $SPLUNK_HOME/etc/system/default/web.conf) file to $SPLUNK_HOME/etc/system/local. Then, delete everything you're NOT changing, leaving only the modified "updateCheckerBaseURL" field. Although you're not experiencing the problem anymore, the above about not modifying files in the "default" directory is quite important to pay attention to, so I wanted to add that.. ... View more

Hi All, thanks for your efforts on this issue, we have figured the issue is with the firewall is down in that site and its not sending the data properly, network team is working on it. thanks all. ... View more

@jtacy Your answer to this question is really helpful for many people. Appreciate your effort. I have one doubt here. I have enabled ssl in the splunk server that means splunk self signed ssl certificate is used. Now I tried this url https://localhost:8443/ from postman tool with ssl certification validation enabled. But i didn't get 200 OK status instead i got below error: "Self-signed SSL certificates are being blocked: Fix this by turning off 'SSL certificate verification' in Settings > General" Then i disabled ssl certification validation option in the tool and then hit this url again https://localhost:8443/. Now i'm getting 200 OK status. So my question here is, Will the below health monitor be able to send HTTPS request to server from F5 and return 200 OK response even though we use self signed certification at server side? Health Monitor Send String: GET /en-US/account/login HTTP/1.1\r\nHost: splunk.company.tld\r\nConnection: close\r\n\r\n ... View more

I converted the comment to an answer. If you press the √Accept you'll get some Karma points. Thanks! ... View more

Woo! Will get this fixed in the next version. (FWIW, I added the import limitations in response to a bug report where another app was overriding one of my macros -- my fix will be to set them to be search, search_activity, ldapsearch, sa-ldapsearch, SA-ldapsearch) Excellent find! ... View more

Actually I believe its a browser cache'ing issue, I just hoped on a different computer and it is indeed gone, woohoo. ... View more