Thanks for the Cribl info, @skoelpin. I'll check it out. ... View more

Were you able to figure this out? Have similar environment that needs similar solution. Thank you! ... View more

Thanks @garethatiag ... View more

I'm running into this same issue and have not found a solution. Was Splunk Support able to help you resolve it? ... View more

Had the same with: Traceback (most recent call last): File "/opt/splunk/bin/rest_handler.py", line 79, in <module> print splunk.rest.dispatch(**params) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 149, in dispatch module = import('splunk.rest.external.%s' % parts[0], None, None, parts[0]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxproxy.py", line 4, in <module> import requests File "/opt/splunk/etc/apps/TA-Swimlane/bin/requests/init.py", line 43, in <module> import urllib3 ImportError: No module named urllib3 Renaming the /opt/splunk/etc/apps/TA-Swimlane/bin/requests folder fixed the issue 🙂 ... View more

You could try using the spath command: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Spath ... View more

On Splunk 6x it is increased to 6 by default, are there any recommendations for dedicated cluster node indexers? I feel that this value is a bit low for dedicated cluster nodes receiving over 200gb of data each day ... View more

Kindly, check for which specific indexes and for which bucket directories it is giving the error. Generally, whenever an index generates too many small tsidx files(more than 25) Splunk is not able to optimize all those files within the specified time period. Kindly, run the below command against the specific directory to optimize it manually:- splunk-optimize -d|--directory Or you can make the below changes in Indexes.conf to fix the issue:- indexes.conf [default] maxConcurrentOptimizes=25 maxRunningProcessGroups=12 processTrackerServiceInterval=0 Please go through the below documentation to have a better understanding of Splunk Optimization. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Optimizeindexes ... View more

Bug SPL-50513 has been filed to address this issue and i appears to be related to bug SPL-21227. ... View more

Yes, this is a much quicker method. Thank you so much. ... View more