Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lawannapage
lawannapage
New Member
Member since:
01-10-2017
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-10-2017 |
Activity Feed
- Posted Change the 'oldest' and 'latest' field values to readible time format using 'strptime' command on Splunk Search. 07-18-2017 02:24 PM
- Tagged Change the 'oldest' and 'latest' field values to readible time format using 'strptime' command on Splunk Search. 07-18-2017 02:24 PM
- Tagged Change the 'oldest' and 'latest' field values to readible time format using 'strptime' command on Splunk Search. 07-18-2017 02:24 PM
- Posted Re: What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-13-2017 06:28 AM
- Posted Re: What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-13-2017 06:24 AM
- Posted Re: What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-12-2017 11:43 AM
- Posted What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-12-2017 11:21 AM
- Tagged What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-12-2017 11:21 AM
- Tagged What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-12-2017 11:21 AM
- Tagged What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-12-2017 11:21 AM
- Tagged What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-12-2017 11:21 AM
- Tagged What is the best order to perform an indexer cluster migration and expansion of both Search Head cluster and Indexer cluster? on Deployment Architecture. 07-12-2017 11:21 AM
- Posted SA-cim_validator: Can this app be installed in a Search Head Cluster environment? on All Apps and Add-ons. 01-10-2017 12:55 PM
- Tagged SA-cim_validator: Can this app be installed in a Search Head Cluster environment? on All Apps and Add-ons. 01-10-2017 12:55 PM
- Tagged SA-cim_validator: Can this app be installed in a Search Head Cluster environment? on All Apps and Add-ons. 01-10-2017 12:55 PM
- Tagged SA-cim_validator: Can this app be installed in a Search Head Cluster environment? on All Apps and Add-ons. 01-10-2017 12:55 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-18-2017
02:24 PM
I'm having trouble changing the 'oldest' and 'latest' field values from epoch time to readible time format using 'strptime' command:
| dbinspect index= | stats min(startEpoch) as oldest max(endEpoch) as latest by index | join type=outer [| rest /services/data/indexes/ | fields title currentDBSizeMB frozenTimePeriodInSecs maxTotalDataSizeMB | rename title as index] | eval premature_aging=if(((now() - 188697600)*1.1) < oldest,"smoke…fire?","aging nicely")
I would appreciate if anyone could help me out.
... View more
07-13-2017
06:28 AM
I would like clarification on this step: alter indexers in the current cluster and assign site. Do you mean to assign the new 11 indexers in the current cluster, then partition all indexers into their respective sites?
... View more
07-13-2017
06:24 AM
Thank you, Adonio! If anyone else has something to add, I would love to hear it.
... View more
07-12-2017
11:43 AM
Forgot to add that we are currently using Splunk version 6.5.2.
... View more
07-12-2017
11:21 AM
What is the best order to perform the above? Our current Splunk environment consists of 5 clustered Indexers and 4 clustered Search Heads load balanced, both single-site. We will be adding 11 Indexers equally distributed between two sites, and an additional 4 Search Heads, equally distributed between two sites, all utilizing an existing Load Balancer.
Indexer cluster will become multisite, but remain single cluster. Search Head cluster will remain a logical single site cluster.
My issue is the order in which the migration and expansion steps should be done. Data migration should not be an issue; we do not currently have an official data retention policy; I'm fairly certain we will let existing single-site data age out. Here is my current outline:
Indexer expansion and Migration
1. Install and configure additional 11 Indexers
2. Add indexers to current site
3. Migrate from single-site to multisite
Search Head expansion
1. Install and configure additional 4 Search Heads
2. Add Search Heads to existing cluster
3. Add Search Heads to Load Balancer
Please advise if this is the best way to proceed, and if not please give recommendations.
... View more
01-10-2017
12:55 PM
I see the instructions for the SA-cim_validator app only include a single-instance install. Can this app be installed in a Search Head Cluster environment?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
