×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
keithevanscdcr
Explorer
Member since: ‎01-13-2021
‎07-09-2025
Community Statistics
Posts 7
Solutions 0
Karma Given 20
Karma Received 0
Member Since ‎01-13-2021
Activity Feed
View All

Re: ERROR DistributedPeerManagerHeartbeat [xxxxx D...

by in Splunk Enterprise
‎11-06-2023 07:59 AM
‎11-06-2023 07:59 AM
Thank you for the clarification.   ... View more

Re: ERROR DistributedPeerManagerHeartbeat [xxxxx D...

by in Splunk Enterprise
‎11-03-2023 04:03 PM
‎11-03-2023 04:03 PM
Are you sure about one sslVerifyServerName = true automatically sets useIPAddressAsHost = false. On the server sslVerifyServerName is the Splunk search head communicating to the indexers for distributed search, the sslVerifyServerName is asking for the certificate CN or SAN to match the server name returned.  It's the Indexer that has to respond to the search with it's server name and not IP.   Seems like these two attributes should be on separate hosts. I am trying to understand as well, but I don't.  Right now we're on 9.0.2 and I'm now getting the below error when using this attribute, where I didn't before:  - Invalid key in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 2: useIPAddrAsHost (value: false).   Thanks much in advance. ... View more

Re: Best method for pulling Microsoft DNS logs wit...

by in Getting Data In
‎01-17-2023 10:31 AM
‎01-17-2023 10:31 AM
If my enterprise AD admins will not allow Splunk Agent on DCs, is DNS Debug logging and Windows Event Forwarding my only option?  Do you have any reference/suggestions regarding this configuration?  Additionally, and read on the article, it seems Stream is the preferred implementation and not DNS Debug. Can you elaborate as to why? Thank you much in advance. ... View more

Indexes.conf Stanza Storage for Indexer Cluster Se...

by in Deployment Architecture
‎03-17-2022 02:45 PM
‎03-17-2022 02:45 PM
Hello all. Thanks in advance for your assistance. I have a 6 node index cluster with a search factor of 6 and replication factor of 3. My ingest is 130GB per/day for proxy data My Hardware: 7TB hot/warm SSD and 112TB cold 10k spindle per/indexer I have a requirement for 30 days hot/warm and 1,065 days cold = 1,095 days (3 years) total Calculations I have found say: (Daily Avg. Ingest x Compression Rate x Num Days Retention) / # of Indexers So: Hot/Warm: 130GB * .6 compression * 15 days) / 6 = 390 GB p/indexer Cold: 130GB * .6 compression * 1,065 days) / 6 = 13,845 GB p/indexer Total: 130GB * .6 compression * 1,095 days) / 6 = 14,235 GB p/indexer Given that, I think my indexes.conf would have: [idx_proxy] homePath = volume:primary/idx_proxy/db coldPath = volume:secondary/idx_proxy/colddb thawedPath = $SPLUNK_DB/idx_proxy/thaweddb maxTotalDataSizeMB = 14576640 maxDataSize = auto_high_volume homePath.maxDataSizeMB = 399360 frozenTimePeriodInSecs = 94608000 The question: With replication factor, I'm thinking this answer is not complete. Can anyone help? Updated formula/calc? This is current storage: [splunk@splunkidx1 ~]$ du -sh /splunkData/*/idx_proxy/ 8.0T /splunkData/cold/idx_proxy/ 947G /splunkData/hot/idx_proxy/ [splunk@splunkidx2 ~]$ du -sh /splunkData/*/idx_proxy/ 8.0T /splunkData/cold/idx_proxy/ 826G /splunkData/hot/idx_proxy/ [splunk@splunkidx3 ~]$ 7.9T /splunkData/cold/idx_proxy/ 955G /splunkData/hot/idx_proxy/ [splunk@splunkidx4 ~]$ du -sh /splunkData/*/idx_proxy/ 7.8T /splunkData/cold/idx_proxy/ 952G /splunkData/hot/idx_proxy/ [splunk@splunkidx5 ~]$ du -sh /splunkData/*/idx_proxy/ 8.0T /splunkData/cold/idx_proxy/ 936G /splunkData/hot/idx_proxy/ [splunk@splunkidx6 ~]$ du -sh /splunkData/*/idx_proxy/ 7.8T /splunkData/cold/idx_proxy/ 911G /splunkData/hot/idx_proxy/ ... View more
Labels

Re: Website Monitoring App stops the splunk servic...

by in All Apps and Add-ons
‎11-18-2021 01:59 PM
‎11-18-2021 01:59 PM
Does anyone know how to determine the App/TA that is calling this?  I had the Zscaler App and TA installed on my test instance and it was throwing an incredible # of errors.  I uninstalled both (zscalersplunkapp, TA-Zscaler_CIM) an these errors disappeared, but I'd like to know how to trace this to the caller instead of removing apps one by one. TIA! ... View more

Re: O365 and Azure AD - estimation of volume of da...

by in All Apps and Add-ons
‎07-13-2021 10:50 AM
‎07-13-2021 10:50 AM
Sizing for O365 is typically not a clear cut exercise. There are so many different variables that can affect the volume. A couple of examples: O365 Subscription type: E1, E3, A5, .. (Will affect the apps they have and the apps that are logged) OneDrive - If customer is redirecting home drives to OneDrive, this creates audit events for every read/write to home directories Customer size Use cases and inputs they turn on\ Customers SSO / federation configuration My preference is to encourage the customer to turn it on for a few hours/days to get a baseline as the inputs will go back and retrieve 30+ days (depending on size of tenant). This can be done on a dev box etc if customer is worried about prod impact.  I normally scope for 500kb > 1mb per user per day (again depending on their usage).  In terms of very rough numbers based on a couple of customers: 5000 users: 3-4GB per day 20000 users: 9GB per day 500,000 users: 40GB per day   ... View more

Re: Why am I getting an invalid eval expression er...

by in All Apps and Add-ons
‎03-11-2021 08:17 PM
‎03-11-2021 08:17 PM
They're still adding this without the quotes in the default app props.conf, WTH... ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎07-09-2025 10:10 AM