I am using Splunk to Search historical data in a virtual index but I have noticed that the default date_year is being incorrectly added.   My data is from 2020 and when I search I specified a source pointing to a  particular directory based on the date at which it was ingested.   Unfortunately the logs in question have a timestamp in the following format %b %e %H:%M:%S i.e no year..   When I run my search looking in the folder for 15/08/2020 some of the default dates are 2020 but some are 2021. index=vix_web        source="/data/xx/xxx/xxx/xxx/2020/08/15"   Having done some research on how the default times are extracted, it would seem  datetime.xml is used but I still don't know where the year is extracted from.   Can anyone help ... View more

I see the following errors when running a search against data in a vix. We have recently upgraded to 8.1.3 when I assume the thirdparty jar files changed from 1.10 to 1.19. I think there is some config that is pointing to the old 1.10.jar file I have looked in indexes.conf for the vix configuration which references the path  changed it to the new version of commons-compress-1.19.jar (see below) and deployed it to the SHC, however it does not seem to make any difference.  Can anyone help? ... View more

Can any one help?   I am trying to configure a KV Store lookup, I have followed the online documentation: https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/ConfigureKVstorelookups and https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles/   However when I try and populate any data into the lookup with an outputlookup command I get: `Error in 'outputlookup' command:Lookup failed because collection 'asset_enrichment' in app 'search does not exist or user does not have read access. I have a simple collections.conf [asset_enrichment] and my transforms.conf [asset_enrichment] external_type = kvstore case_sensitive_match = false collection = asset_enrichment fields_list = _key, asset_enrichment guid, ........ etc Both deployed to my SHC. My assumption is that they are only required on the SH and not the index cluster due to the KV store living on the SH?   I have created a Lookup definitition    But if I look in Settings - Lookups - Lookup table files my look up is not listed at all.   Any suggestions? ... View more

I have a warning on Monitoring console of my cluster master, that my Index disk utilisation is critically high. I have a 30 day retention policy set on all my indexes however the disk utilisation is continuing to rise. In monitoring console - Indexing - indexes and volumes - instance - Indexes table. I am seeing Data Age vs Frozen age that I have data much older than my retention policy. To me that would suggest I have hot buckets that have not rolled over perhaps due to data ingest latency or incorrect timestamps preventing the roll over. Could this be the source of my increasing disk utilisation? My understanding is that if a rolling restart of my Indexers occurred then all buckets would roll over, however I know there has been a restart within the time frame indicated by the data age. ... View more