About pacifikn

pacifikn

Thank you so much for your kind help @PickleRick .

pacifikn

Thank you so much, Actually i wanted to see how much data is consumed on disk per each day. splunk btool indexes list | grep 'Path =' The above command , which Path you mean here? the second command gives me this in one indexer: [root@Splunkidx1 splunk]# du -ksx /opt/splunk/var/lib/splunk 47263660 /opt/splunk/var/lib/splunk [root@Splunkidx1 splunk]# Is the 47263660 , is the data consumed per day? if not how can i see the amount of data, disk consumed per day? - I want to check all these and know , how much other storage to buy , so that i can be able to store more data for longtime? -Thank you in advance.

pacifikn

Thank you again @PickleRick for your quick response, - Is there any query that can show me the final volume of data indexed in indexers per day in GB? * in CLI / GUI? -Thank you in advance

pacifikn

Thank you so much @PickleRick for your kind support and response, I got now the point, may you please share/guide me how to use query or other way i can use to check on GUI/CLI the total data indexed per day in GB after this exercise (15% for compressed raw data, 35% for indexes) ? Thank you in advance.

pacifikn

Hello dear @PickleRick , thank you for your feedback, But i didn't well understood, let me again explain well my question in details, Actually I have a license of 200GB/per day? but when I check is license used previous 30 days, the average is between 36GB and 54GB , means per day i cannot pass 60gb, I also have 5 indexers and each has the space of 2T , BUT I WANT TO KEEP MY DATA FOR LONGTIME FOR 5YEARS, HOW DO I CALCULATE THIS TO GET THE STORAGE FIT THE 5 YEARS?which query or formula can i use? HOW MANY Terabyte(TB) I WILL NEED TO KEEP MY DATA FOR 5YEARS in the scenario above, Thank you in advance!

pacifikn

index=_internal source=*license_usage.log type=Usage | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx date_mday date_month date_year | stats max(volume_b) by idx date_month date_year help me to edit this query to get the output in GB and also calculate the total number of all index in GB? Thank you in advance

pacifikn

How do I use this query to get the data in GB in readable format? index=_internal source=*license_usage.log type=Usage | timechart span=1d sum(eval(b/1024/1024/1024)) AS volume_b by idx - I also want to see how much data stored in all indexers per day, per month and per year? ,what is the query i can use? Thank you in advance

pacifikn

Greetings!! 1.a. I need to check data size indexed in indexers per day, per month and per year in GB? 1.b. what if the data ingested per day is 200GB/day, How do I calculate to know the storage that can store all the indexed data in 5 years? or one year? and month? 2- how to install and configure indexers to be functioning? 3- How to configure syslog in splunk instance to receive logs? i have already configured network devices to send logs into splunk instance? what other steps remaining to do to receive logs in indexer? Kindly help me, Thank you in advance

pacifikn · ‎02-24-2022

Greetings!!! How can i install splunk indexers in centos 7? What I will need and what are steps to follow ? I need to setup splunk TEst Environment, So far I have only installed Splunk enterprise as Search Head and I am able to browse it through web GUI and create users, I need also to INSTALL SPLUNK INDEXERS? AND splunk forwarder, and also install splunk management node that will be able to receive syslog from network security devices source and manages search head , KINDLY HELP me and guide me with the steps??? Thank you in advance!!!

pacifikn · ‎02-11-2022

Thank you dear @PickleRick for your quick response about this matter, I would also need to know the list of things/requirements will have to implement this TEST environment to work same as the production env one. 1- which VM i will use? VirtualBox will work? 2- For OS is choose CentOS as the one i use in production? am i going to install other centos for each components(5 indexers, 1 SH ,1 Management node) to match the the numbers of the components in production?????? OR i will use one? 3- About Splunk enterprise software, am going to use this one for Download free- 60 trial (https://www.splunk.com/en_us/download/splunk-enterprise.html) OR i will use the one i used in production?????? 4- What about the indexers and how i will install and configure it, is there any link related or another guidance so that it can meet the production? 5- Kindly help me with the list of things i need to have in test environment to meet the production and what to do next? Thank you in advance

pacifikn · ‎02-10-2022

Greetings!!!! Dear All, I really need your help and guidance, I want to create a "Test environment " that is similar to the Live production , **What I want to have in the test environment , - In my production, i have 7 servers (one for Search Head, second for Search head management(splunk instance), and other 5 remaining are the indexers), AND I WANT TO HAVE THE SAME IN TEST ENVIRONMENT, I have read the splunk documentation, but It is not guide me well. I want your help and advice me, how to create this???? SO far I have downloaded Virtualbox and centos 7, Kindly help me and guide me, what the requirements i need to have so that i can create this test environment same as the production one? - what splunk enterprise software i will use, is it the free 60 day or i will have to take copy the one i used in the production and use it in test env? I'm lost kindly help how i can have this distribution in environment , what i must have to successfully create this Test environment same as production one I mentioned above and have ALL those components in test environment, Thank you in advance.

pacifikn · ‎02-05-2022

Thank you @kkrises for your advice and guidance, When I have downloaded the version of Splunk ES https://splunkbase.splunk.com/app/xxx/, is this enough to upgrade splunk ES to 7.0.0 and Splunk Enterprise version 8.1.x- 8.2.4)???? or I have to also download other one for Splunk Enterprise version 8.1.x to 8.2.4 ????? Another question, what command to use in CLI or use GUI to upgrade after getting upgrade version file splunk-enterprise-security_700.spl ??? Kindly help me, how to upgrate it after getting this upgrade version file? Thank you in advance

pacifikn · ‎02-04-2022

@Thank you dear @richgalloway for your guidance, The only problem, I still have, I have seen splunk ES has various versions of Splunk enterprise that is compatible to splunk ES v 7.0.0 - May you help me how i can upgrade splunk enterprise to the latest one which is 8.2.4 and Splunk ES to 7.00, is it possible to upgrade splunk enterprise from 7.2.6 to 8.2.4 ???? also possible to upgrade splunk ES from 5.3.0 to 7.0.0 ???? If possible may you please guide me how to upgrade them, what are the requirements??? Kindly help me on this cause in the documents is little bit confused, i don't well understand this, Thank you in advance.

pacifikn · ‎02-03-2022

Dear @gcusello , is there any guidance on how to create test environment step by step or you can advise me , here i think we'll use a single instance deployment? - is it possible that you can do this test environment and work as production for free? - what splunk enterprise and splunk enterprise security we can use for testing environment? free splunk enterprise is limited to 500MB only and i don't what to use so that you can do the test environment which can be similar to the production? what are I required to have?and how to do it? Kindly guide me on this, as i want to create test environment similar to the production? Thank you in advance!! Thank you

pacifikn · ‎02-03-2022

Greetings!!! How to updrade from 5.3.0 to SPlunk Enterprise Security version 7.0, I am having splunk enterprise 7.2.6, Kindly advise & guide me how can i upgrade it? Thank you in advance!

pacifikn · ‎02-02-2022

Greetings!! Need your advice and opinions on the following points: - What training can I take to master splunk admin troubleshooting issues and complete the admin training package, - Is there a way to set or have a simulator that can help a team or someone to have a test environment to practice more on splunk troubleshooting and not the Live environment, is there any advice on this to still be able to play with the simulator or how to set up the test environment? Kindly need your advice on these, Thank you in advance.

pacifikn · ‎01-25-2022

Greetings! How to create tickets in splunk and assign it to someone? Thank you in advance!

pacifikn · ‎01-16-2022

Thank you so muchMr @isoutamo for your help, yes we actually use LVM, And as i trace all the indexers i found in : /dev/mapper/centos-opt , on some of indexer is almost full 92%, and on the other indexer is full 100%, what are the way forward to resolve this, May you please guide me on how to fix this? there is no way to reduce this by delete maybe the old data instead of add other space? need your advice and guidance on this, Thank you in advance!

pacifikn · ‎01-16-2022

Dear Team, Greetings!! I need your help and guidance on the following issue , i keep getting this error in the notifications message: Search peer Splunk-idx4 has the following message: The minimum dree disk space (5000MB) reached for opt/splunk/var/run/splunk/dispatch. Problem replicating config (bundle) to search peer '10.10.5.106:8089' , HTTP response code 500 (HTTP/1.1 500 Error writing to /opt/splunk/var/run/searchpeers/Splunksh01-1642302054.bundle.53d7c4e2bfaedd1d.tmp: NO space left on device). Error writing to /opt/splunk/var/run/searchpeers/Splunksh01-1642302054.bundle.fbc779696ccbf76a.tmp: No space left on the device (unknown write error) Even on the search and reporting when i run a query, it gives this error, 2 error occurred while the search was executing. Therefore, search results might be incomplete. Hide errors . [Splunk id-03] Failed to read size=3307 event(s) from raw data in bucket='nsoc_fw_ahnlab~703~B239BEEE-90FA-43C8-ADDA-620D3FACAB66' path ='/opt/splunk_data/indexes/nsoc_fw_ahnlab/db/hot_v1_703. Rawdata may be corrupt, see seach log. Results may be incomplete! . [Splunk id-03] Failed to read size=5030 event(s) from raw data in bucket='nsoc_fw_ahnlab~703~B239BEEE-90FA-43C8-ADDA-620D3FACAB66' path ='/opt/splunk_data/indexes/nsoc_fw_ahnlab/db/hot_v1_703. Rawdata may be corrupt, see seach log. Results may be incomplete! Kindly help me and guide me on how to fix the above issue. Thank you in advance!

pacifikn · ‎01-12-2022

Greetings!! I need help!!! am experiencing an error while am doing search, the error is: Search peer Splkidx04 has the following message: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch. Problem replicating config (bundle) to search peer ' 10.10.x.96:8089 ', HTTP response code 500 (HTTP/1.1 500 Error writing to /opt/splunk/var/run/searchpeers/Splunksh1-1641956462.bundle.4ef204fd344a6181.tmp: No space left on device). Error writing to /opt/splunk/var/run/searchpeers/Splunksh01-1641956462.bundle.4ef204fd344a6181.tmp: No space left on device (Unknown write error) . 1/12/2022, 10:44:22 AM The search process with sid=scheduler__pacyn__search__RMD5837e19b530431259_at_1641973200_94478 on peer=Spkidx4 might have returned partial results due to a reading error while waiting for the peer. This can occur if the peer unexpectedly closes or resets the connection during a planned restart. Try running the search again. Learn more. 1/12/2022, 9:43:09 AM Search peer Splkidx4 has the following message: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch. 1/12/2022, 10:59:00 AM 5 errors has occurred while the search was executing. therefore search results might be incomplete. hide ..... Kindly help me on how i can fix this above issue. Thank you in advance!

Posts	101
Solutions	1
Karma Given	10
Karma Received	2
Member Since	‎10-27-2019

Online Status	Offline
Date Last Visited	a month ago

How to to check data size indexed in indexers per...

How can install splunk indexers in centos?

How create a Test distribution Environment that is...

Splunk Enterprise Security upgrade

splunk troubleshooting Training

How to create tickets and assign it to someone?

Error while searching and other error in the notif...

Error of Problem replicating config (bundle) to se...

where i can find the retention configuration for S...

how to to calculate average size of a syslog messa...

Re: How to to check data size indexed in indexers...

Re: Indexers

Re: Indexers

Re: Indexers

Re: Indexers

Re: How to create a report that shows max indexed ...

Re: How to create a report that shows max indexed ...

How to to check data size indexed in indexers per...

How can install splunk indexers in centos?

Re: create a Test distribution Environment

How create a Test distribution Environment that is...

Re: Splunk Enterprise Security upgrade

Re: Splunk Enterprise Security upgrade

Re: splunk troubleshooting Training

Splunk Enterprise Security upgrade

splunk troubleshooting Training

How to create tickets and assign it to someone?

Re: Error of Problem replicating config (bundle) t...

Error while searching and other error in the notif...

Error of Problem replicating config (bundle) to se...