@hrawat wrote: maxKbps is calculated from name=thruput. Since it's missing, so maxKbps is not working/applied. Thx. Splunk is certain they will not back port the fix to 9.3.x and 9.4.x? Having per_*_thruput *and* maxKbps broken w/o the workaround seems worthy of a back port. Or at the very least, the "Known Issues" for SPL-263518 should be updated to mention maxKbps not working / applied. ... View more

@hrawat wrote: Note: As a side effect of this issue, maxKbps(limits.conf) will also be impacted as it requires thruput metrics to function. Can you elaborate on how maxKbps is impacted? ... View more

@hrawat wrote: As mentioned before 9.2 outputs.conf was never reloadable ( no-op for _reload), thus no crashes/complications We've used /services/data/outputs/tcp/server/_reload to successfully reload updated `clientCert` certificates and `server` hosts for years when using Splunk Enterprise 8.x and 9.0.x instances. ... View more

@hrawat wrote: Protocol levels. 0: Maximum network traffic over S2S connection. 1: Network traffic optimization over S2S connection. 2: Additional network traffic optimization over S2S connection. 3: Metric support. 4: Ack support for rawless metric events. 5: Flag potential dup events. 6: Flag for cloned metric events so that cloned events exempted from license usage. 7: SSL certificate requests This is the first time I recall seeing any documentation on the protocol levels. Can you elaborate what "7: SSL certificate requests" means? ... View more

The AutoLoadBalancedConnectionStrategy message contains several fields  oneTimeClient=0 _events.size()=20 _refCount=2 _waitingAckQ.size()=4 Warningcount=20 What do these fields mean and at what values do we need to be concerned? ... View more

Scarily enough, it appears to be enabled by default. At least with 9.3.1, this feature is not enabled by default: search_history_storage_mode = <string> * The storage mode by which a search head cluster saves search history. * Valid storage modes include "csv" and "kvstore". [...] * Default: csv https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/Limitsconf#History ... View more

@PickleRick I believe the intent of the original post is memory usage of a newly installed Splunk UF that hasn't been configured with additional `inputs.conf` aside from Splunk's defaults. @hrawat What, if any, drawbacks are there to setting `max_inactive = 10`? Splunk Support referred me to your post for a support case I filed that matches your original post. ... View more

Assuming I understood your question correctly, I was able to update the default.xml for the 'search' app using: cat test.xml <nav search_view="search" color="#5CC05A"> <view name="search" default="true" /> <view name="analytics_workspace" /> <view name="datasets" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> </nav> curl -ks -u admin:"${pw}" https://localhost:8089/servicesNS/nobody/search/data/ui/nav/default --data-urlencode eai:data@test.xml ... View more