No, because that data was indexed before and you paid for that "index process". Don't worry about that. ... View more

Which version of splunk are you using? in the new Splunk Version 8.0, python support for 2.7 has been deprecated. Check this out: https://docs.splunk.com/Documentation/Splunk/latest/Python3Migration/AboutMigration ... View more

Hello, In the last months the education team make some changes, some of my certifications were lost for a couple of days. Send a email to Splunk Certification Team , just please elaborate. Regards. ... View more

Yes, of course: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Restorearchiveddata#Thaw_a_4.2.2B_archive ... View more

Splunk diag? ... View more

Yeah, thats the issue... good luck! ... View more

In this kind of errors we must perform a check list to ensure everything was deploy properly. Your HW is compliant with the minimun and recommended specifications? Your server and OS is 64bit? Do you have enough space in your server? If the HW is not enough you will have a lot of problems. Please check the following log: $ cat SPLUNK_HOME/var/log/splunk/health.log Did you install splunk with a noon root user? $ ls -la $SPLUNK_HOME Remember DIAG is your best FRIEND! Diag provides insight into your instance: - How is the isntance configured - What was the condition up the point that diag ran Gather data based on Splunk components: - OS setting, internal lgos, configuration files, etc. - Produces a tar.gz file and diag.log No customer data is retrieved. $./splunk diag -> Check for any errors. Did you make an Splunk upgrade? Check the logs to verify if there was a problem during the process: SPLUNK_HOME/var/log/splunk/migration.log. = Notable Logs for crashes = Check if crash*log exists or splunkd_stderr.log Hope this help! ... View more

Probably a sub search will work for you. source=mytable1 [SEARCH source=mytable2 mycolumn2=myvalue | FIELDS mycolumn2] ... View more

Probably you installed a universal forwarder in the same server. Could you please run the following command in your CentOS server: $ ps -A | grep splunk And show me the output please? ... View more

Hi! Remeber a timestamp need two elements "date" and "time", so the first step is concatenate the LDATE and LTIME columns. The next step is apply some of the following functions described in the following link: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/DateandTimeFunctions Probably the mask that you are looking for is similar to "%Y%m%d%H%M%S". ... View more

Wich versión of Splunk Enterprise are you using for ES deployment? ... View more