Hi Splunk gurus, Just wanted to enquire if anyone has seen any correlation between high IOWait and CPU utilization? I have a client that is experiencing some search performance issues after upgrading from version 8.2.9 to version 9.0.6. Their users are complaining about search lag and overall slowness in Splunk Web when running searches. Just curious if anyone has encountered this? Thank you in advance for any answers given 🙂   Mikhael ... View more

Hi, I recently came across this warning on Splunk web and was just wondering if anyone else has encountered this before and how to go about solving it? The warning is as follows: "Events are not displayed in the search results because _raw fields exceed the limit of 16777216 characters. Ensure that _raw fields are below the given character limit or switch to the CSV serialization format by setting 'results_serial_format=csv' in limits.conf. Switching to the CSV serialization....." Any input is greatly appreciated and thank you in advance. Mikhael ... View more

Hi, I was going through my Splunk setup and came across this warning when I was clicking on LDAP Groups under "Authentication Methods > LDAP strategies" "LDAP server warning: Size limit exceeded"   I was just wondering what could be the cause and how to resolve this warning?   Thank you in advance for any assistance.   Mikhael   ... View more

Hi, My client has encountered the following issue below and I was just wondering if anyone has encountered something similar? - Encountered the following error eventtype "xxxxxxxxx" does not exist or is disabled when running a search using a specific index/sourcetype. They have mentioned that the affected eventtype has the proper permissions. - Search is able to return results for a shorter timeframe (ie 3 months) as compared to a longer timeframe (1 year). Thank you in advance for any information given 🙂 Mikhael ... View more

Hi, I was posed a query from my customer. Is it possible to forward syslog from UF to Syslog-ng using the BSD/IETF syslog format? If so, how would one go about implementing it? Thank you in advance for any information provided. Regards, Mikhael ... View more

Hi, I just wanted to ask if there are specific ways or cli commands to check if my log sources adhere to CIM? I've checked the following link below but I need assistance outside of the CIM add-on. https://docs.splunk.com/Documentation/CIM/5.0.2/User/UsetheCIMtovalidateyourdata Thank you in advance. Mikhael ... View more

Hi, Apologies if the subject is a bit vague but I would like to know if there is a way to check overall Events Per Second ingestion? Is it through the Monitoring Console? Thank you in advance. Mikhael ... View more

Hi, I was just curious if Splunk Universal Forwarder has any dependency with JRE/JDK as I am planning to upgrade JRE/JDK on my Windows machines and if there is a dependency, how do I go about performing the upgrade? Would I have to stop the Splunk Universal Forwarder service first before upgrading  or can I just upgrade as per  ... View more

Hi,  First off, apologies if this is the wrong forum to post this but I am stuck and need help. I currently have a test environment set up as below. Symantec SEPM is sending syslog to a vip load balancer which will then forward to either one of two HF.  Flow is as follows: Symantec SEPM > LB > HF   Configuration as shown below: Symantec SEPM version 14.3 RU1 with the following syslog configuration Syslog IP:  VIP of Load Balancer Syslog dest port: TCP 514 Syslog Line Separator: LF   LB is configured to forward the logs to HF via port 9997   Issue: Currently, the issue is that the risk logs used to be sending over previously but seem to stop now.   If I have missed out anything, please let me know.   Any feedback is greatly appreciated.    Regards, Mikhael ... View more