About aborgna512

aborgna512 · ‎04-19-2022

I have come across a unique issue with the MS Cloud Services app when assigning an input for a single storage table. The API works as expected when I initially set the input with a Start Time. However, the data does not continue to collect/ingest beyond the timestamp when the input is configured, unless there is manually intervention/manipulation on my part to the input Start Time. Example: If I set a Start Time to 2 weeks prior and save the input, it will collect data from the Storage Table at 2 weeks prior up to the time the input is saved in Splunk. The input will generate 0 results after that time. I checked in Azure Storage Explorer and the Table in question continues to write new entries in the same format. I have confirmed Splunk can see that data because it will start collecting new data only after I manually update the Start Time in the input. I checked the mscs:storage:table:log and there are no errors with the API input functionally and it shows attempts at the designated interval(5 minutes). Historically with this input, I've had success by leaving the Start Time to the default(30 days) and setting the table list to * to collect everything. However, this table is part of a very large blob that cannot be pulled in the same fashion. I'm hoping to get some ideas about what could be causing this break in log collection and see if there is something I may be overlooking. Any input would be greatly appreciated.

aborgna512 · ‎03-17-2022

Thank you Rich for the feedback. We plan to start small and scale out with VDIs in the long run. The image template is what we are working on to be able to quickly deploy VDIs with installed UFs to meet our needs. I appreciate the swift response.

aborgna512 · ‎03-17-2022

I'm looking for some clarity about the recommended process for installing UFs in a VDI environment (e.g. Azure Virtual Desktop, VMWare Horizon, etc.). I'm familiar with the host image install and clone process that is outlined in the splunk docs link below. Is this process recommended for deploying VDIs? Install on the parent VDI and clone down to the child VDI sessions. Please advise if there are any special considerations for VDI vs. traditional VM creation/deployment. Integrate a universal forwarder onto a system image - Splunk Documentation

aborgna512 · ‎04-29-2021

@richgalloway. Our hardware/cabling teams have decided to perform the network cable swap in one night. I won't need to make any changes to the index aging configurations since cold-frozen connection on all indexers will be done in a matter of a few hours and we'll be online to monitor indexer health during the process. Thank you so much for the feedback and we'll make a note of the solution if needed in the future.

aborgna512 · ‎04-23-2021

@richgallowayThank you for the quick response. That stanza value is staggered for our indexes based on volume/priority ranging from 100 days to 2 years. It makes sense to me that increasing frozenTimePeriodInSecs by 10 days should keep the data in cold storage for the time frame of the work. Our /splunk_cold volume settings are currently fixed near the max of that directory. If space becomes a problem, we'll know about it from internal monitoring as we have alert triggers set up when it hits >90% & 95% utilization on the file system.

aborgna512 · ‎04-22-2021

My organization is running 9 physical indexers that are connected to NFS mounts where the frozen buckets are rolled to after aging out. There is a project in planning to move/migrate the physical cable connections on indexers that feeds to the NFS mount. I'm looking for advice on the best strategy to keep the indexer cluster ecosystem peaceful during migration. The physical connection from indexer to NFS will need to be disconnected for 3 days-1 week to allow for migration of the connection/cables to their future switch homes. The directory that holds the cold buckets has more than adequate storage to hold more/larger buckets during this migration time. Is there a recommended method/process to extend/expand the volume on cold buckets in the cluster that can be implemented temporarily during this maintenance window? It could then be restored to original configuration once the NFS mounts are reconnected? I was thinking that increasing the cold storage max volume(coldPath.maxDataSizeMB ) in indexes.conf prior to disconnect might provide this type of cover. However, I would love a second opinion given this is the first time I've been encountered with this type of request. Any insight/advise that can be provided would be greatly appreciated.

Posts	6
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎04-22-2021

Online Status	Offline
Date Last Visited	‎06-21-2023 09:49 AM

Why is MS Cloud Services app not collecting recent...

Clarify UF install process for VDI environment

Splunk physical indexers require maintenance to mo...

Why is MS Cloud Services app not collecting recent...

Re: Clarify UF install process for VDI environment

Clarify UF install process for VDI environment

Re: Splunk physical indexers require maintenance t...

Re: Splunk physical indexers require maintenance t...

Splunk physical indexers require maintenance to mo...