About Santosh2

Santosh2 · ‎10-03-2022

Hi, when i am checking the health check dashboard i saw error in indexing ready. Indexing Ready Root Cause: Cluster is not indexing ready, please bring up at least RF number of peers. Unhealthy Instance: xxxxx Last 50 related messages: None Note: the instance is not active instance. But when i check SF and RF are met it is showing How to resolve this issue????

Santosh2 · ‎09-01-2022

but how can i identify that

Santosh2 · ‎09-01-2022

Santosh2 · ‎08-30-2022

We are receiving error from _internal index for Json logs: 1. error: ERROR JsonLineBreaker - JSON StreamId:1254678906 had parsing error:Unexpected character: "s" 2. error: ERROR JsonLineBreaker - JSON StreamId:1254678906 had parsing error:Unexpected character: "a" sample logs: { [-] level: debug message: Creating a new instance of inquiry call timestamp: 2022-08-25T20:30:45.678Z } my props.conf: TIME_PREFIX=timestamp" : " TIME_FORMAT= %Y-%m-%dT%H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD=40 TZ=UTC how to resolve this issue.

Santosh2 · ‎08-21-2022

Hi, i came to know the issue, i was doing a wrong query. Now the issue resolved. Thanks in advance

Santosh2 · ‎08-16-2022

Hi All, I have one dashboard in that I am fetching the results from a input look up file. I am getting the results but result are getting combined (multiple field values into single event) But I want them separately like how we have updated in our look up file In the same way I want to see in splunk. Lookup file data: Storage_name type. Quality Abcd. Fty. 100 Efgd. Iju. 2000 Ghyu. Thu. 3455 Gfhbv. Uyhgt. 4556 Any suggestions

Santosh2 · ‎07-26-2022

sorry for the late reply.... Yes as you said the buckets contains old and new data, i checked my props.conf, everthing looks good and no warnings are seen in spunkd logs as well, linebreaking is happening correctly, but still i am able to see 2 years old data. I tried to change the forzentimeperiod to 3 days as well, but still i can see the old data.

Santosh2 · ‎07-14-2022

i am new to splunk, can u please tell indetail, how can check in monitor console. And what will be the solution

Santosh2 · ‎07-13-2022

Splunk data retention period is for 7 days. But i could still see 2 years back data now. I am not sure why? Can anyone help on this

Santosh2 · ‎06-26-2022

i have two types of events which starts with below two formats: 2022-01-18 15:20:42,727, xyz........................ [Sun Mar 16 15:21:18.350517 2022], xyz................. what all need to write in props.conf to see both types of events.

Santosh2 · ‎05-14-2022

Hi all, I can see the logs coming in from a particular source=das*.log through backend Linux but when I search with the same source I cannot see data in ui One more thing if I use with index name and source also I am not getting any data in ui Note: when I searched with internal index I could see logs from that host IP but not from the source in ui Can any one help on this issue.

Santosh2 · ‎05-13-2022

Index=XYZ source= abc*.logs host=kfg So I when I checked in internal index data is coming from host, I checked forwarder server class mapping is fine, I could see the data is deploying. But still cannot see data. What other steps i need to follow to get data in index XYZ

Posts	12
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-13-2022

Online Status	Offline
Date Last Visited	‎10-08-2022 12:22 PM

Health Check issue- How to fix this error?

Why are we receiving error from _internal index f...

Field values from look up to query?

Why am I still seeing old data?

Need line breaker for below two types of events

Why can I not see the data in Splunk UI?

With data not indexing, what are other steps to fo...