About Zacknoid

Zacknoid · ‎09-09-2024

Hi Peter, Could you please check event Queue --> Event Queue Backlog: Check if event queues on the forwarders are building up (seen in metrics.log). This can happen if there's too much data being processed at once. Another thing to monitor is the network, during the logs stop any changes on the network utilization ( both receivers side forwarder's end ) Also ensure the following inputs on the forwarder side ( this worked in my case, but results may vary in your setup ) useACK=false autoBatch=false

Zacknoid · ‎08-01-2023

I tried changing the timezone of the app from the "preferences" option, its not reflecting, also only this particular dashboard having the different timezone.

Zacknoid · ‎08-01-2023

Hello Splunkers, I am trying to change the last updated time on the IT essential work dashboard, ( attached screenshot ). the following time zone is not coming from the servers and also the timezone in splunk is not this. I am trying to change this to +4 GMT,

Zacknoid · ‎10-03-2022

facing this issue second time, and tried almost every possible way out in last 2 months, so here is the csv file we're which is getting referesh in every 1 hour, ( it may or may not contain new events ) We observed after few hours file stop getting into splunk and after splunk restart again it start ingesting data. In the splunkd logs its says ignoring path, I have tried crcSalt, initCrcLenth but non worked in my case All i want splunk is to read new file always no matter is there is new events or not, just stay updated with file ( i cannot add counter in file )

Zacknoid · ‎07-14-2022

Still looking for resolution, ingestion latency error

Zacknoid · ‎06-28-2022

Upgraded to version 9.0 facing similar issue : Root Cause(s) Indicator 'ingestion_latency_gap_multiplier' exceeded configured value. did you find out any solution for this ?? Thanks

Zacknoid · ‎05-20-2022

We're using intermediate forwarders to send data from one level to another, as in between there are firewall and communication though one HF to another HF on another level. we're collecting all data from UF's and using HF to push it to another level with all firewall rules and policies. I am trying with DEST_KEY is _MetaData:Index . Use upper case on the left side of the = in transforms.conf. Do you have any document link referring to the same ? | THANKS

Zacknoid · ‎05-09-2022

Hello everyone, I am trying to separate data getting into the main index from particular hosts. I am trying Transforms.conf [windows_ot] DEST_KEY = _metadata_index Regex = HOst123 Format = host_wineventlog Source_key = Metadata:Host Props.conf [wineventlog] Transforms-setindex = windows_ot Do we have another way to separate 26 host's data ( without accessing the host machines ) The following data flow level 2 (Heavyforwarder) sending data to ---> level 3 (heavy forwarder) ---> main HF Is it a way to separate data in the main HF ?? also is trans conf correct ??

Posts	8
Solutions	0
Karma Given	11
Karma Received	3
Member Since	‎03-17-2022

Online Status	Offline
Date Last Visited	‎09-26-2024 08:43 AM

How to change the time of ITEW Dashboard?

File Monitroring issue- Why did csv file stop gett...

How to Separate data from main index/HF?

Re: Splunk UF Windows Security Event logs just see...

Re: I am trying to change the time of ITEW Dashboa...

How to change the time of ITEW Dashboard?

File Monitroring issue- Why did csv file stop gett...

Re: Why are we receiving this Ingestion Latency er...

Re: Why are we receiving this Ingestion Latency er...

Re: How to Separate data from main index/HF?

How to Separate data from main index/HF?

Are you a member of the Splunk Community?