Hi Splunk Folks, We have Splunk Physical Servers with 8GB disk space storage for /opt folder which frequently reaching 90% of the disk space threshold (7.2GB). Since we cannot easily upgrade the disk space because these are Physical servers, we are looking for files that we can remove or migrate. We found this "/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/save" folder (1GB in size) that seems like containing the same files (btree_index.dat, btree_records.dat and snapshot) with its predecessor folder (/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db) Are questions are, what are these Splunk files do and does it safe if we will delete or move them to another folder to free some disk space on /opt? Here is the commands we used to check which file has consume a large volume of diskspace -bash-4.2$ df -h /opt/splunk Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg00-opt 8.0G 6.5G 1.6G 82% /opt -bash-4.2$ du -h --max-depth=1 /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db 1001M /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/save (Has the most consumed diskspace) 335M /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot 1.7G /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/ (Total) If we look inside the "save" folder from /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db, we can see it has same files (btree_index.dat, btree_records.dat and snapshot) . Thus it just might be a backup of splunk_private_db -bash-4.2$ ls -l /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db -rw-------. 1 splunk splunk 104865400 Jun 24 04:52 btree_index.dat -rw-------. 1 splunk splunk 246211800 Jun 24 04:56 btree_records.dat drwx------. 3 splunk splunk 79 Jun 24 04:49 save drwx------. 2 splunk splunk 70 Jun 24 04:49 snapshot -bash-4.2$ ls -l /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/save -rw-------. 1 splunk splunk 152715440 Nov 22 2019 btree_index.dat -rw-------. 1 splunk splunk 371572840 Nov 22 2019 btree_records.dat drwx------. 2 splunk splunk 70 Nov 22 2019 snapshot   Regards, John Kevin Aracan ... View more

Hi Splunkers, One of our Splunk Clustered Indexer (Physical Server) will go thru to a battery replacement that might take around 1-2 hours. With this, we would like to seek your advice since this one Splunk Clustered Indexer (Physical Server) will be down for around 1-2 hours during the battery replacement. During the Splunk Clustered Indexer (Physical Server) battery replacement, do we need to initiate maintenance-mode or run splunk offline command? We would like to hear your feedback to avoid bucket related issues. Regards, Kevin ... View more

Hi Team, Just wanted to check with you what is the difference between host and NetworkDeviceName in Cisco ISE context? I had use the SPL queries below and have different results. index=cisco_ise | stats count by host index=cisco_ise | stats count by NetworkDeviceName A little background on Architecture, we have Syslog servers (Splunk Forwarders as well) where cisco ise traffic logs are written, then we use Splunk file monitoring to check those cisco ise traffic logs and ingest it to Splunk. We also have Splunk Add-on for Cisco ISE installed on those Syslog servers/Splunk Forwarders. Then we have that Splunk Add-on for Cisco ISE also on our Indexer Tier and Search Tier for field extraction and other conf. On our Search Head, we have the SplunkApp for Cisco ISE. Regards, Jaracan ... View more

Is Splunk Cisco ISE app and Splunk Cisco ISE Add-on already map to Splunk CIM by default? If not, is there any documentation that we can use to map it and be CIM compliant? ... View more

Just a quick question on Splunk Upgrade for ES https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/CompatMatrix We are currently on Splunk ES v5.0.1 and Splunk Enterprise v7.0.13.1. Now,we wanted to version upgrade to Splunk ES v5.3.1 and Splunk Enterprise v7.2.9.1. With this, since we need to consider compatibility, do we need to upgrade to Splunk Enterprise v7.1.x first then upgrade Splunk ES App to v5.3.1, then we will upgrade to Splunk Enterprise v7.2.9.1 after? Is that correct? Or we can directly upgrade both from Splunk Enterprise v7.0.13.1 to v7.2.9.1 and Splunk ES App v5.0.1 to v5.3.1? Let me know which approach is correct. ... View more

In Splunk Enterprise, the minimum free disk space (5000MB) is needed. For Splunk Universal Forwarder, what is the minimum free disk space? ... View more

Hi Team, We are using Splunk in AWS EC2 Instance. The SSL Certificate is uploaded on the AWS Application Load Balancer. With that, how can we resolve the SSL Self Signed Cert Vulnerability for port 8089? Any insights? I already had added the confs below, but still the vulnerability was still there. web.conf [settings] sslVersions = *,-ssl3 enableSplunkWebSSL = true cipherSuite = TLSv1.2:!aNULL server.conf [sslConfig] sslVersions = *,-ssl3 ... View more

Hi, We had put one of our Peers/Indexers (Lets name it IDX2) into manual detention using the command below: Run in IDX2 /opt/splunk/bin/splunk edit cluster-config -manual_detention on And then, we can see on the Peer Status "ManualDetention" on CM GUI's Indexer Clustering : Master Node Dashboard. Now, we had added some conf files on the IDX2 and restarted the instance. Run in IDX2 /opt/splunk/bin/splunk restart The splunkd of IDX2 is now up and running. However, on the CM's Indexer Clustering : Master Node Dashboard, the Peer Status is "Stopped" and not fully searcheable. We tried to execute manual detention off using command below, but it did not respond. Run in IDX2 /opt/splunk/bin/splunk edit cluster-config -manual_detention off Run in CM /opt/splunk/bin/splunk edit cluster-config -peer -manual_detention off It says it was unsuccessful. Do we need some time for it to reflect, or the have something to check on why the peer status on CM is not reflected? ... View more