@gcusello , So can we upgrade SH now and then update Indexer (later)-more than a month later Searches will run fine against 8.2.4 indexers just fine?   Thanks, Neerav ... View more

Hi, I am stupid. One of the guys had renamed the default host name for Index settings for this HF. So the logs were being forwarded under a different server name. Should've been the first thing to check. Appreciate the help and thanks for your time !!! Thanks, Neerav ... View more

Hi,  Is it something like the below search? index=_internal group=queue | eval percfull=((current_size_kb/max_size_kb)*100) | search percfull>80 | dedup host, name | table _time host name current_size_kb max_size_kb When running this on my search head I see my other heavy forwarders but the concerned HF is not returned in the results. Also, there is a search which is running on all our heavy forwarders which writes data in summary index on our indexers. This HF is running the search and data is displayed but not ingested.  Thanks, Neerav ... View more

Hi gcusello, No results for this search. Seems like a system issue then. Ideas for troubleshooting??  Thanks, Neerav  ... View more

@somesoni2  Awesome..Thanks for your help !! ... View more

@somesoni2 , Thanks, another question. We have multiple standalone Indexers as search peer to our search head cluster, will it be an issue to add indexer clustering to this search head cluster? In other words can 1 search head cluster have standalone Indexers as search peers and Indexer clustering both working at the same time?  ... View more

@PickleRick @jamie00171  Thanks for your suggestion. Discussion with the client are on... Will need to open firewall ports and test it out. Will keep you guys posted.. Thanks, Neerav Mathur ... View more

@PickleRick @richgalloway , Actually the site (DC) A is already up with IDX 1 & IDX 2 (NOT in Indexer Cluster) and so client has come up with this requirement.  We are fine with having 2 different cluster masters (1 for each Indexer Cluster), but we have only active 1 search head cluster (In DC A) with DC B Search Head cluster being in DR mode. So I guess the main question is there a way I can use these 2 Cluster Masters with 1 Search Head cluster? Please suggest. Thanks for your help. Thanks, Neerav   ... View more

That worked like a charm !! Thanks Again... ... View more

@gcusello  This is exactly what I was hoping to hear...Will surely try that and will update you.. Thanks a lot for your quick and prompt response... Thanks, Neerav ... View more

Hi @PickleRick , After a long discussion we have decided to use an IMAP based shared mail box where splunk user will have access and use the app-TA-mailclient to ingest the mails. Will let you know about the progress. Thanks ... View more

@PickleRick Thanks for your prompt response.... We have Oracle OEM sending out error messages via emails to some users and we need a splunk specific account which can be added on this mail. So we would need to ingest actual mail body as they contain info about Oracle alerts. These users have domain/NT account email IDs (O365). Need help regarding what app to use compatible with splunk 8.0.0 and some details of how to set it up. xxxxxxxxxxxxxxxxxxxSAMPLE MAILxxxxxxxxxxxxxxxxxxxxxxxxxxxxx From: 13 C Oracle EM Notifications Sent: Tuesday, September 28, 2021 10:22 AM To: X.Y@abc.com Subject: EM Event: Critical:bwprod - SQL running For Long TIme: UserInfo = Inst: 3\,SID:2338 \, OSUSER:xxxxxx-yyyy \, machine:US*******\, sql_id:2ptaaaaaaaaaaaaar Time(in mins) = 76 Host=us********** Target type=Cluster Database Target name=bwprod2 Categories=Performance Message=SQL running For Long TIme: UserInfo = Inst: 3\,SID:2338 \, OSUSER:xxxxxx-yyyy \, machine:US*******\, sql_id:2ptaaaaaaaaaaaaar Time(in mins) = 76 Severity=Critical Event reported time=Sep 28, 2021 10:22:13 AM EDT Operating System=Linux Platform=x86_64 Associated Incident Id=3777777 Associated Incident Status=New Associated Incident Owner= Associated Incident Acknowledged By Owner=No Associated Incident Priority=None Associated Incident Escalation Level=0 Event Type=Metric Alert Event name=ME$Long_running_queries:Elapsed_Time_mins Metric Group=ME$Long_running_queries Metric=Elapsed_Time_mins Metric value=76 Key Value=Inst: 3\,SID:2338 \, OSUSER:xxxxxx-yyyy \, machine:US*******\, sql_id:2ptaaaaaaaaaaaaar Time(in mins) = 76 Key Column 1=Userinfo Rule Name=xxxxxxxxxxxxxxx Rule Owner=xyxyxyxyx Update Details: SQL running For Long TIme: UserInfo = Inst: 3\,SID:2338 \, OSUSER:xxxxxx-yyyy \, machine:US*******\, sql_id:2ptaaaaaaaaaaaaar Time(in mins) = 76 Incident created by rule (Name = Incident management rule set for all targets, Create incident for critical metric alerts [System generated rule]).     Thanks, Neerav     ... View more

Hi @venkatasri  Not sure how to check that. But all I can say is that on pasting the URL on browser it gives me a  Cannot GET /healthCheckapi However splunk WSM dashboard shows a 404 (Client Error)    Thanks for your response.... ... View more