About kbecker - Splunk Community

Topics I've Started

Subject

Karma

Author

Latest Post

View Packet Payload in Stream

0

by

Search Head Cluster: How do I resolve "Error Fixup...

5

by

Splunk DB Connect 2: What is the proper syntax for...

3

by

Should the list of fields be separated by a space ...

1

by

DBConnect Java Error After Starting Splunk

0

by

Is the directory for the splunkd.pid configurable

0

by

Can outputs.conf be reloaded without restarting sp...

0

by

How do you enable debug logging for scripted input

1

by

What Happened to "Events Table" in 4.3

1

by

What does the following "red bar" message mean "Re...

1

by

Have the same requirement. Just set frozen time period and maxtotaldatasizemb to some very large value ( greater than physical disk you have ). Then nothing will get deleted until frozen time period which in your case is 7 years.

+1 for the feature request to parallel fsck. Since this isn't avail. wrote a quick bash script that generates a list of buckets to fsck and uses the parallel command to kick of many bucket fsck's at a time. I then distributed this to hundred plus indexers and executed via pssh. #!/bin/bash # Find buckets between two epoch time stamps and output to file /data/index/splunk/bin/splunk fsck scan --all-buckets-one-index --index-name=_internal --min-ET=1483250400 --max-LT=1485928800 > /home/splunk/bucket_repair_07152017/buckets_tmp.list 2>&1 # Format bucket list cat /home/splunk/bucket_repair_07152017/buckets_tmp.list | grep idx | cut -d " " -f 4 | cut -d "=" -f 2 | cut -d "'" -f 2 > /home/splunk/bucket_repair_07152017/buckets.list # Fix buckets cat /home/splunk/bucket_repair_07152017/buckets.list | parallel /data/index/splunk/bin/splunk fsck repair --one-bucket --bucket-path={} >> /home/splunk/bucket_repair_07152017/buckets_repair.log 2>&1

We are running 6.5.1 and no longer have this issue. I think there was some internal Splunk confusion in regards to which release this was actually fixed in.

Ignore my comment, this was a config issue. The jira admins changed the port we needed to update our configs.

The Jira add on also working after upgrading to 6.5.1. In the search.log I see this error 12-21-2016 06:52:52.475 WARN ScriptRunner - Killing script, probably timed out, grace=0sec, script="/data/search/splunk/bin/python /data/search/splunk/etc/apps/jira/bin/jira_rest.py jqlsearch project=itw" If you look at the duration of the is its < 1 sec. This search has completed and has returned 1 results by scanning 0 events in 0.13 seconds

This does increase the value but there is still an upper limit that is hard coded

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support case for this? We are trying to get Splunk to remove this limit and more customers behind this will help drive this. Thanks, Ken

Have you opened a support ticket with Splunk, we are trying to get them to remove these limits and more customers will help drive this.

Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.

Have you opened a case with Splunk for this? This is a hard limit which we have an enhancement request ticket open, more customers requesting this to be raised should push Splunk to fix this.

We are using 6.3.1 and I still see the " These results may be truncated. Your search generated too much data for the current visualization configuration." message even with the following two options set. Is there still an bug associated with this? 10000000 10000000 This is the search earliest=-60m index=_introspection host=carf-splunkil* component=Hostwide | timechart useother=f limit=80 span=10s values(data.normalized_load_avg_1min) by host

Using 6.3.1, this is a distributed search cluster and indexer cluster. We are only seeing this on 3 of 80 indexes. Es indexes are on this indexer cluster and a standalone search head is running Es.

I am seeing this too. ERROR EAIOutParameters - invalid entry title in toAtom(): INDEXER_MISSING_INDEX-p\x00\x00z\x00fr

It looks like you need to tune the line breaking of these events as in your example Splunk is merging 4 log events into a separate Splunk events (check out props.conf). Once you have line breaking setup properly your searches should work as currently Splunk is trying to extract 4 values for this event and only one of them is winning.

Karma from

User

Karma Count

1

1

1

1

1

Karma given to

User

Karma Count

1

1

1

1

1