About Prakhar_shukla

adonio · ‎05-09-2017

I have to remind myself to never assume. better make this setting global to avoid future problem as yo encountered now

tweaktubbie · ‎04-28-2017

In general: have you set up the HF as a search head too? Sounds like it's not the case, and therefor the HF does what it's supposed to do - just forward events/results. And that seems best practice for a HF. If you install the DBC app on your searchhead, it'll retrieve stats from your indexers. Note: you can keep the inputs running on the HF and use the app here just for the stats and GUI panels. You could use the HF as searchhead too, but sounds like a waste of resources and extra traffic.

Prakhar_shukla · ‎04-26-2017

thanks for quick response. but how about data input. from where exactly it comes. Like core splunk we use Forwarder to indexer > then search head. or directly to splunk instance where ES is installed?

Prakhar_shukla · ‎04-26-2017

i have upgraded the splunk ES version to 4.7 and it seems to fixed the issue

richgalloway · ‎03-15-2018

@alekszubr, You're adding on to a year-old thread that has an accepted answer. For better chances at a helpful response, please post a new question describing your problem.

Prakhar_shukla · ‎04-05-2017

thanks cusello, woodcock. yes it worked after replacing source with sourcetype.

Prakhar_shukla · ‎04-02-2017

thanks cusllo and woodcock, apart from adding the last line of the stanza, i had to enable index acknowlegment to make it work

Prakhar_shukla · ‎03-28-2017

somehow my license usage have no value in any of indexer. i am not sure why however, i reinstalled enterprise trial version on all indexer and able to work for now. hopefully wont have similar problem again.

adonio · ‎03-23-2017

maybe its not clear enough. master uri is the address (ip or fqdn) of the Cluster Master. you have to set it only on the indexers not on the Cluster Master itself. first, enable clustering on the master and set rep factor search factor and pass4symmkey then restart. now go to the peers (Indexers) and add them one by one by enabling clustering and putting the Cluster Master as master_uri the peer will connect to the master and will tell it, "hey i am peer abc.com"

Prakhar_shukla · ‎04-10-2017

it is most likely happening because of corrupted buckets, you can see them in cluster master webpage as well. to fix the issue you need to remove them. please see how to remove bucket in this post https://answers.splunk.com/answers/184484/what-should-i-do-with-bad-buckets-in-a-clustered-e.html?sort=votes

khyoung7410 · ‎05-01-2017

enable and disable done. But there is no difference.

PhilipDudley · ‎09-06-2017

Best answer for automating the deployment of Splunk Apps.

Posts	45
Solutions	2
Karma Given	1
Karma Received	2
Member Since	‎03-23-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

index replication in custom index

DB connect app DB health issue

Splunk enterprise security input data

Failed to execute KV Store lookup

Error while installing Splunk Enterprise security

data masking not working

send data from heavy forwarder to peer index

license error in trail version of splunk

When adding peer node servers in server.conf, do I...

Re: index replication in custom index

Re: DB connect app DB health issue

Re: Splunk enterprise security input data

Re: Failed to execute KV Store lookup

Re: Error while installing Splunk Enterprise secur...

Re: data masking not working

Re: send data from heavy forwarder to peer index

Re: license error in trail version of splunk

Re: When adding peer node servers in server.conf, ...

Re: Replication Factor and Search Factor is never ...

Re: Error "Duplicate Servername"

Re: How to install a splunk app?

Are you a member of the Splunk Community?