Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sohailmohammed
sohailmohammed
Explorer
Member since:
01-13-2022
03-07-2022
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 01-13-2022 |
Activity Feed
- Posted How to see newly created calculated field/field alias/field extraction in the logs ? on Splunk Enterprise Security. 03-01-2022 01:24 AM
- Tagged How to see newly created calculated field/field alias/field extraction in the logs ? on Splunk Enterprise Security. 03-01-2022 01:24 AM
- Tagged How to see newly created calculated field/field alias/field extraction in the logs ? on Splunk Enterprise Security. 03-01-2022 01:24 AM
- Got Karma for Re: One of the SHC member is going up and down every 5 mins in UI but shows running fine on backend CLI.. 02-18-2022 10:49 AM
- Posted Re: Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-31-2022 01:59 PM
- Posted Re: Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-31-2022 12:02 PM
- Posted Re: Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-31-2022 11:59 AM
- Posted Re: How a different users can get different results for the same query? on All Apps and Add-ons. 01-28-2022 11:43 AM
- Posted Re: Why is my REST call from one search head to another search head not returning anything? on Deployment Architecture. 01-28-2022 11:20 AM
- Posted Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-28-2022 11:02 AM
- Tagged Different results for same search on same search head for rest call or save search. on Splunk Enterprise Security. 01-28-2022 11:02 AM
- Posted Re: Why do I get different results from save search on Splunk Search. 01-28-2022 10:58 AM
- Posted Re: One of the SHC member is going up and down every 5 mins in UI but shows running fine on backend CLI. on Deployment Architecture. 01-25-2022 07:33 AM
- Tagged One of the SHC member is going up and down every 5 mins in UI but shows running fine on backend CLI. on Deployment Architecture. 01-24-2022 11:48 AM
- Posted One of the SHC member is going up and down every 5 mins in UI but shows running fine on backend CLI. on Deployment Architecture. 01-24-2022 11:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-01-2022
01:24 AM
Hi All,
I have created a newly created field/field alias/field extraction with GLOBAL Permissions. Example | eval test="MyApp" This works fine when I use it in search but when I save it as calculated field it doesn't show up. I refreshed 10 times even cleared browser cache and logged back in. Still same issue. We don't see newly created KO in the logs but can run those in searches.
Any inputs or help @woodcock @Splunkers 2022
... View more
Labels
01-31-2022
01:59 PM
same search, same role, same permission, same time and same search head. Thank you
... View more
01-31-2022
12:02 PM
| rest splunk_server=local /servicesNS/-/-/data/ui/views | stats count by label, title, eai:appName, author results for user1: 580 results for user2: 600 same search same role same time and same search head.
... View more
01-31-2022
11:59 AM
Same search , same time range, same search head and same role.
... View more
01-28-2022
11:43 AM
Hey Madhan45, Did you resolve this issue ? I am facing the same issue here. I have users with same roles but gives different results on same search head. Please let me know
... View more
01-28-2022
11:20 AM
Hello there, I am facing the same issue here.. I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 305 on same h1 search head. What may be the problem ? Also if I get 300 results on SH H1, I see different count on H2 with 310 results.. what is the issue here for this inconsistencies ?
... View more
01-28-2022
11:02 AM
Hello there, I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 305 on same h1 search head. What may be the problem ? Also if I get 300 results on SH H1, I see different count on H2 with 310 results.. what is the issue here for this inconsistencies ?
... View more
- Tags:
- search head cluster
Labels
- Labels:
-
using Enterprise Security
01-28-2022
10:58 AM
Hello there, I am facing the same issue here.. I get different results when I run a rest call. For example I ran a rest command to bring all the dashboards on h1 search head it brings 300 to me and for my colleague it brings 305 on same h1 search head. What may be the problem ? Also if I get 300 results on SH H1, I see different count on H2 with 310 results.. what is the issue here for this inconsistencies ?
... View more
01-25-2022
07:33 AM
1 Karma
The solution to the above issue was to create ssl cert that fixed it although my internal certs for the server were not expired. I just recreated the certs on all SHC members and did the kv store clean up on the one which was stuck. And it got resynched in 20 mins 🙂 Recreating certs with ./splunk createssl To check expiration: openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem cd /opt/splunk/etc/auth && /opt/splunk/bin/splunk createssl server-cert -d . -n server
... View more
01-24-2022
11:47 AM
On of the SHC member is going up and down every 5 mins. KV Store is stuck at starting first and then it is stuck at intial sync. The member is running fine from backend and going to up and down in the search head clustering page. I did try splunk restart on that member server and then the KV are rebuilding and getting stuck at each phase first at starting and now at the inital sync. Any help/inputs appreciated @rbal_splunk Thank you
... View more
- Tags:
- kv store
Labels
- Labels:
-
search head clustering
