About BRG

BRG · ‎05-20-2021

On latest version 8.0.2, if license master is down will search work or it will wait for 72 hours & then stop?

BRG · ‎05-02-2021

@tscroggins I have upgraded all the instance from 6.6 to 7.3.2, only one splunk indexer I have directly upgraded from 6.4 to 7.3.2, I have not seen any error in indexer cluster & license master. Now I am going to upgrade from 7.3 to 8.x . Just last query why splunk recommends to upgrade 6.6 version from 6.4 and then upgrade to 7.3, why can't I directly upgrade from 6.4 to 7.3 version for all the splunk instance.

BRG · ‎05-02-2021

Thanks for the info. By mistake I have upgrade one indexer from 6.4 version to 7.3.2. Will it affect any performance issue? Please confirm. Is there anyway to rollback the version upgrade? Also I am planning to upgrade splunk version to 8.x version from 7.3.2 by the end of this month.

BRG · ‎05-01-2021

What will happen if source type is incorrectly assign & how should i change it?

BRG · ‎05-01-2021

Hello Guys, Currently I am using splunk 6.4 version in my organization. I want to upgrade all splunk instance to 7.3.2 version. Can i directly upgrade splunk version from 6.4 to 7.3.2 ? If no then in which version should i go first & why.

BRG · ‎09-17-2020

Sorry for the late reply, Even though i tried to remove the file but its giving me error of Read-only file system. rm: cannot remove `splunkd.pid': Read-only file system Also moving file to another location is also not working. Can we have any other option?

BRG · ‎08-10-2020

@impurush Thanks for the info. file name conf-mutator.pid have also same pid no. i.e 21888, do i have to remove this file also ?

BRG · ‎08-10-2020

@isoutamoThanks for the info. I have checked file permission on other working indexers also, Its same only. Can you plz guide me how to find any corrupted data

BRG · ‎08-10-2020

@impurush Will this change impact the other nodes in Indexer cluster ? As this is in production setup. Also version of splunk is old.

BRG · ‎08-10-2020

I am having indexer clusters & one of the indexer goes down due to some reason, I am unable to start splunk in that server. Its giving me below error. [root@ bin]# ./splunk start splunkd 21888 was not running. Stopping splunk helpers... [ OK ] Done. Stopped helpers. Removing stale pid file... Can't unlink pid file "/opt/splunk/var/run/splunk/splunkd.pid": Read-only file system splunk version is 6.4.2 . kindly help me to start splunk service.

Posts	10
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎08-10-2020

Online Status	Offline
Date Last Visited	‎05-20-2021 03:48 AM

Splunk License Master down

Incorrect Source type assign

Splunk Upgrade Query

Unable to start splunk in Indexer

Splunk License Master down

Re: Splunk Upgrade Query

Re: Splunk Upgrade Query

Incorrect Source type assign

Splunk Upgrade Query

Re: Unable to start splunk in Indexer

Re: Unable to start splunk in Indexer

Re: Unable to start splunk in Indexer

Re: Unable to start splunk in Indexer

Unable to start splunk in Indexer