Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Reethika
Reethika
Path Finder
Member since:
06-11-2020
10-23-2020
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 1 |
| Member Since | 06-11-2020 |
Activity Feed
- Posted Re: In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. on Splunk Enterprise. 10-21-2020 10:09 AM
- Karma Re: In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. for richgalloway. 10-21-2020 10:08 AM
- Posted Re: In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. on Splunk Enterprise. 10-21-2020 05:21 AM
- Karma Re: In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. for sylim_splunk. 10-21-2020 04:54 AM
- Posted Re: In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. on Splunk Enterprise. 10-21-2020 01:51 AM
- Karma Re: In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. for richgalloway. 10-21-2020 01:51 AM
- Got Karma for In searchhead cluster with six machines, only one SH machine is not giving results for a particular app.. 10-20-2020 01:01 PM
- Posted Re: In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. on Splunk Enterprise. 10-20-2020 06:36 AM
- Tagged In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. on Splunk Enterprise. 10-20-2020 06:35 AM
- Tagged In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. on Splunk Enterprise. 10-20-2020 06:34 AM
- Posted In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. on Splunk Enterprise. 10-20-2020 02:11 AM
- Tagged CLI search query not giving results. Working fine on searchhead GUI on Splunk Search. 07-23-2020 03:16 AM
- Tagged CLI search query not giving results. Working fine on searchhead GUI on Splunk Search. 07-23-2020 03:16 AM
- Posted CLI search query not giving results. Working fine on searchhead GUI on Splunk Search. 07-22-2020 11:41 PM
- Karma Re: Help with error from a custom command: ERROR SearchStatusEnforcer - sid:1536453655.14705 Search auto-canceled for mbadhusha_splun. 07-16-2020 06:02 AM
- Karma Re: what does these files from searchhead mean? for anilchaithu. 07-16-2020 05:51 AM
- Posted Searchquery error on Splunk Search. 07-16-2020 05:49 AM
- Posted Re: High disk space utilization on indexer on Monitoring Splunk. 07-01-2020 08:21 AM
- Karma Re: index data missing in a particular time period. for richgalloway. 07-01-2020 07:52 AM
- Posted index data missing in a particular time period. on Knowledge Management. 06-30-2020 10:06 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-21-2020
10:09 AM
[clustering] master_uri = https://1*****************:8089 mode = searchhead multisite = true pass4SymmKey=******************* Multisite is true
... View more
10-21-2020
05:21 AM
The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but the search head is missing the 'multisite' attribute.' for master=https://************************ : 8089. This is the error I see on that particular SH
... View more
10-21-2020
01:51 AM
It's an Enterprise security app, And a particular dashboard "Incident Review" is give error as "Search did not return any events." on one SH. On other searchhead we are getting results.
... View more
10-20-2020
06:36 AM
@richgalloway @anilchaithu @sylim_splunk Can you please help
... View more
10-20-2020
02:11 AM
1 Karma
In searchhead cluster with six machines, only one SH machine is not giving results for a particular app. We have checked right corner>help>about>server. All 5 other SH's giving results for this dashboard, except one. Could anyone suggest with some troubleshooting? I have cross-checked app config, among SHM Thanks.
... View more
- Tags:
- cluster
- searchhead
Labels
07-22-2020
11:41 PM
Hi, /opt/splunk/bin/splunk search " index=**** sourcetype="*****:proxylogs" earliest=-15m@m latest=now | fields action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time ')" Result : INFO: No matching fields exist. INFO: Your timerange was substituted based on your search string Above is the search for which no results are returned from CLI. From GUI(Searchhead) I get results. Could anyone please help. Thanks
... View more
Labels
- Labels:
-
field extraction
07-16-2020
05:49 AM
Hi, While I'm running splunk for a search for timeperiod = 1year. I always getting this error [xxxxindexernamexxxx] Failed to read size=1 event(s) from rawdata in bucket='os~708~1FBB5DA1-4091-4DEA-9134-E6C689617D66' path='/opt/splunkcolddata/os/colddb/rb_1590815402_1590790190_708_1FBB5DA1-4091-4DEA-9134-E6C689617D66. Rawdata may be corrupt, see search.log. Results may be incomplete! Does this mean that particular file "rb_1590815402_1590790190_708_1FBB5DA1-4091-4DEA-9134-E6C689617D66" is corrupted? If so can we retrieve this? Thanks.
... View more
Labels
- Labels:
-
search job inspector
07-01-2020
08:21 AM
@gcusello, @richgalloway "temp "its an index, can't find it on web interface though. cat /opt/splunk/etc/apps/Axxxxxxxxxxxxxxxxxxxx/default/indexes.conf [_internal] maxTotalDataSizeMB = 70000 homePath.maxDataSizeMB = 10000 homePath = $SPLUNK_DB/_internaldb/db coldPath.maxDataSizeMB = 60000 coldPath = $SPLUNK_DB/_internaldb/colddb thawedPath = $SPLUNK_DB/_internaldb/thaweddb frozenTimePeriodInSecs = 7776000 These are parameters used, and restarted. but didn't work. earlier frozenTimePeriodInSecs was about an year. coldPath.maxDataSizeMB > frozenTimePeriodInSecs ? maxDataSizeMB rules over frozenTimePeriodInSecs ? Reducing coldPath.maxDataSizeMB can help? Thanks.
... View more
06-30-2020
10:06 AM
So data of an index missing from a 30thmay to 20th june. I was crosschecking it through epoch time of missing period. I could files in index/db/ What does these files mean? -rw------- 1 root root 0 Jun 10 00:16 rb_1591740508_1591694190_1481_B0964DEC-509D-40A9-A451-529E6E725A5F.rbsentinel drwx------ 3 root root 4096 Jun 10 09:11 rb_1591743776_1591657655_2201_7934D4E6-9F8E-4A10-9002-279FAC932938 But still data isn't reflecting on search. Is my troubleshooting wrong for missing indexes. Any recommended troubleshooting? Thanks.
... View more
Labels
- Labels:
-
data model
-
summary indexing
06-29-2020
11:53 PM
Thanks @sylim_splunk @anilchaithu In times of high disk utilization, can we delete them manually? Is it recommended?
... View more
06-29-2020
01:27 AM
Hi, What does these files mean. In dir /opt/splunk 1.5M rsa_scheduler__nobody_U3BsdW5rX1NBX0NJTQ__RMD5ba43509e6e89712f_at_1593296280_9250_98A434A0-EF12-4A03-865F-58FC89DB3621 1.5M scheduler__nobody_U0EtSWRlbnRpdHlNYW5hZ2VtZW50__RMD5f155b8fe52024c5b_at_1593277800_8402_D42B43D6-7CD8-49F4-8960-5743B7FBF310 Thanks.
... View more
Labels
06-22-2020
01:55 AM
Is it normal to have colddb > db? 4.0K thaweddb 20M summary 4.2G datamodel_summary 9.8G db 59G colddb [root@xxxxxxxplunkdata/_internaldb
... View more
Labels
- Labels:
-
indexer
-
indexing performance
06-22-2020
01:52 AM
We noticed that a host "1234" is not longer connecting with the DS. What does this mean? What would be the impact? How do we troubleshoot this? Thanks.
... View more
- Tags:
- depolyment server
Labels
- Labels:
-
forwarder
-
forwarder management
06-18-2020
10:37 PM
db_183236610_1832273414_19315 what does this mean? Its part an index data.
... View more
Labels
- Labels:
-
other
-
search macro
-
summary indexing
06-17-2020
05:26 AM
Hi @richgalloway @gcusello , So In my case, I have reduced retention period from 1 year to 3 months for an index. And after restarting splunk, its still the same. and after a day the utilization have increased. In my scenario, /opt/splunkdata/temp/ filepath, db datamodel summary are present in /temp. Thanks.
... View more
06-12-2020
09:10 PM
Thanks @gcusello . As suggested, data retention period is reduced for internal index. But the utilization is same. New FrozenTimePeriodInSecs parameter is applicable only future to be indexed data. And old index data would be same. Please can you clear this out.
... View more
06-12-2020
08:39 AM
Hi, Please suggest me, Methods for freeing some space on /opt/splunkcolddata on indexer. how to reduce the retention data, for indexed data. Thanks.
... View more
- Tags:
- disk-usage
Labels
06-12-2020
08:35 AM
Thankyou @richgalloway . /opt/splunkdata have "temp" directory, which consumes most data. cleaning this directory is suggested?
... View more
06-11-2020
06:35 AM
Hi. I have disk space issue with indexer. where there is 92% utilization in opt/splunkdata dir. and most space consuming files in this directory are db files, such as "_internal_db" and some other temp folders, which also contain dbs. I'm not sure which of them to clear. Almost all files in directory are db. could please suggest want kind of data can deleted to free some space without loosing important data. Thanks in advance.
... View more
Labels
- Labels:
-
indexer
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-23-2020
12:14 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 4 | |
| 2 | |
| 1 | |
| 2 | |
| 1 |
