Thanks for the clarification on the _internal index retention. It was certainly a File & directories input. The person that created the input/index has since left & I need the source file to replicate the regex/indexing. I'll see what I can dig up outside of Splunk. Appreciate the input! ... View more

Thanks Giuseppe, The wildcard in the search returns the same information. There's no retention issues on that index (no maximum on index size). I'd assume the information is available in a Splunk log file, not the indexed data.  Thanks again Simon   ... View more

No changes needed to be made to exceed 4 clusters. Perhaps check the permissions on the config files in TA_EMC-Isilon/local folder to ensure you can write to them.   Look at your splunkd.log for detailed errors on why it's failing.  Another option is to copy the lines of check from an existing host & paste/change IP to the new cluster you're trying to add directly in the TA_EMC-Isilon/local/inputs.conf file: Eg below: [isilon://10.xxx.xxx.xxx::/platform/1/statistics/current?substr=true&keys=node.clientstats.active&devid=all] endpoint = https://10.117.66.97:8080/platform/1/statistics/current?substr=true&keys=node.clientstats.active&devid=all sourcetype = emc:isilon:rest interval = 120 index = isilon response_handler = IsilonResponseHandler The new cluster will need to be added to the passwords.conf & isilonappsetup.conf (the password may not work if it's unencrypted but worth a try).   ... View more

Just updated one of our clusters to 9.1.0.8 - No issues with the Splunk app at all ... View more

Thanks for the info - we have 6 Isilon clusters (8.2.2) in Splunk but am starting the oneFS 9.1.0.8 upgrades this week. Will see why the app isn't compatible after the upgrade & see if it can be modified to work with 9.x OneFS.  Will let you know how it goes. ... View more