Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rako1980
rako1980
Explorer
Member since:
09-12-2019
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 09-12-2019 |
Activity Feed
- Got Karma for Reduce the 200G limit in data collection in SII. 06-05-2020 12:50 AM
- Posted Re: Shrink data in splunk insight for infrastructure on Splunk ITSI. 11-06-2019 02:53 PM
- Posted Re: Reduce the 200G limit in data collection in SII on Splunk ITSI. 11-06-2019 10:34 AM
- Posted Re: Shrink data in splunk insight for infrastructure on Splunk ITSI. 11-04-2019 07:06 AM
- Posted Re: Shrink data in splunk insight for infrastructure on Splunk ITSI. 10-28-2019 05:11 AM
- Posted Re: Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-25-2019 01:14 PM
- Posted Re: Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-24-2019 08:20 AM
- Posted Re: Shrink data in splunk insight for infrastructure on Splunk ITSI. 10-23-2019 06:01 AM
- Posted Re: Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-23-2019 05:28 AM
- Posted Shrink data in splunk insight for infrastructure on Splunk ITSI. 10-18-2019 11:21 PM
- Tagged Shrink data in splunk insight for infrastructure on Splunk ITSI. 10-18-2019 11:21 PM
- Posted Re: Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-18-2019 10:16 PM
- Posted Re: Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-09-2019 02:22 PM
- Posted Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-07-2019 07:05 AM
- Tagged Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-07-2019 07:05 AM
- Tagged Reduce the 200G limit in data collection in SII on Splunk ITSI. 10-07-2019 07:05 AM
- Posted 32 bit client on Splunk ITSI. 09-12-2019 08:04 AM
- Tagged 32 bit client on Splunk ITSI. 09-12-2019 08:04 AM
- Tagged 32 bit client on Splunk ITSI. 09-12-2019 08:04 AM
- Tagged 32 bit client on Splunk ITSI. 09-12-2019 08:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 |
11-06-2019
02:53 PM
Not sure. Is it a single tar installation, and standalone installation. This is not an installation of app in splunk enterprise.
https://docs.splunk.com/Documentation/Infrastructure/1.4.0/Install/InstallOnLinux
... View more
11-06-2019
10:34 AM
Not sure if I understood "which volume". These are the p;aces I added those parameters and restart the spunk:
grep maxVolumeDataSizeMB -R /opt/splunk/etc | grep -v README
/opt/splunk/etc/system/local/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/default/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/local/indexes.conf:maxVolumeDataSizeMB = 10480
... View more
11-04-2019
07:06 AM
@woodcock I created these files as they were not there, and restarted. No affect seen:
```
grep maxVolumeDataSizeMB -R /opt/splunk/etc | grep -v README
/opt/splunk/etc/system/local/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/default/indexes.conf:maxVolumeDataSizeMB = 10480
/opt/splunk/etc/apps/splunk_app_infrastructure/local/indexes.conf:maxVolumeDataSizeMB = 10480
```
... View more
10-28-2019
05:11 AM
Yes, it uses collectd. SII by default (or probably only way) uses collectd.
... View more
10-25-2019
01:14 PM
@twhite_splunk My understanding, SII collects data from log and metrics both. SII docs states that the installation includes only 200G of data. I would like to reduce that whole in general to use much lesser than 200G. Note that this is a standalone SII installation
... View more
10-24-2019
08:20 AM
@pwu_splunk I have set the parameter as instructed, but I do not see the data shrink.
root@**:~# grep maxVolume /opt/splunk/etc/system/local/indexes.conf
maxVolumeDataSizeMB = 10480
root@*:~# du -hs /opt/splunk/var/lib/splunk
19G /opt/splunk/var/lib/splunk
I have restarted the splunk servoce. So splunkd process was restarted.
I am using the Splunk Insight for Infrastructure and not the Splunk Enterprise.
... View more
10-23-2019
06:01 AM
Not during the ingest. But truncate or cleanup whatever has been collected; logs and metrics data. We have small infrastructure and not much of disks to store all those SII data.
... View more
10-23-2019
05:28 AM
@twhite_splunk That is correct. Looking for guidance on how can I configure to make SII data to use certain amount of space instead of default 200G. If not, also a way to clean up the SII data to truncate or reduce the s[ace occupied. Thanks you.
... View more
10-18-2019
11:21 PM
How can I shrink or truncate the data in splunk insight for infrastructure?
... View more
10-18-2019
10:16 PM
Anyone? I need to have Splunk Insight for Infrastructure only limit to 20G or so instead of 200G default.
... View more
10-09-2019
02:22 PM
Well, it is probably one of the settings in /opt/splunk/etc/system/default/server.conf, but not exactly user. Anyway, I edited the min minFreeSpace = 500, but modifying the setting shows following warning in the dashbaord:
Installed Files Integrity Checker: Unable to access or parse the contents of manifest file in SPLUNK_HOME directory. As a result, file integrity information is not available. Verify manifest file in SPLUNK_HOME directory is still present, and that the splunk service user context will have read-access.
It would be nice if we can have SII to configure with lower limit than 200G than above min free space settings.
... View more
10-07-2019
07:05 AM
1 Karma
For my small number of hosts being monitored by Splunk Insight in Infrastructure, I would like to limit the 200G limit to much lower like 50G or so, so that I think the purging works automatically after it hits the limit. How do I lower that limit? I don't want splunk insight to reach 200G limit.
One thing I thought was just let the SII server to have around 50G disk, but it stops the collection as soon as there is only 5G left with error:
ERROR DiskMon - Disk Monitor: The index processor has paused data flow. Current free disk space on partition '/' has fallen to 4998MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/em_metrics/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data.
... View more
09-12-2019
08:04 AM
From this link, looks like 32 bit OS for Ubuntu 14.04 is supported for data collection:
https://docs.splunk.com/Documentation/Infrastructure/1.4.0/Install/SystemRequirements#Operating_system_support_for_data_collection
But, the install script for splunk insight for infrastructure does not provide the 32 bit installation. I got an error:
‘splunkforwarder-7.2.4-8a94541dcfac-Linux-x86_64.tgz’ saved [24611103/24611103]", "", "install_uf.sh: line 266: /opt//splunkforwarder/bin/splunk: cannot execute binary file: Exec format error", "install_uf.sh: line 267: /opt//splunkforwarder/bin/splunk: cannot execute binary file: Exec format error"]
How do I add the data collection for 32 bit OS?
Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
