Hello Team, I did same, you all suggested, but it doesn't work me Etc/system/local/inputs.conf [splunktcp://9997] connection_host = none Any other work around?   Regard Steven ... View more

On your indexing layer, run the following from the command line: splunk btool indexes list <INDEXNAME> --debug Replacing with the name of the index that you are seeing issues with. There are a few properties to take note of: 1) coldPath.maxDataSizeMB -- The total size in MB of the Cold path for data. If this size is exceeded, data will roll to frozen (and if there is no Cold-To-Frozen archiving strategy in place, will be deleted) 2) frozenTimePeriodInSecs -- The number of seconds before data is frozen 3) maxTotalDataSizeMB -- The maximum total size across all hot/warm/cold data locations See if any of these are lower than you expect. ... View more

Search heads need space too, for things like search artifacts: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Dispatchdirectoryandsearchartifacts You should check to see where the disk space is being used, and to make sure that your search head is in fact forwarding events to the index tier. ... View more

There is no property called owner for apps however to see owner of elements within an app you can go to the Splunk Web home page, click the Gear icon next to Apps find the particular app and click "View objects" to see a list of any configurations and their owners. ... View more

Hi @muez, your data seems to be structured data, do they come from a csv? In this case, put props.conf on Universal Forwarder that ingests csv. Ciao. Giuseppe ... View more

WE DO HAVE BIGGEST CONCERN ABOUT HAVING KNOWLEDGE OBJECTS ON THEM. WHAT TO DO? ... View more