Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About marka3721
marka3721
Loves-to-Learn
Member since:
11-14-2022
07-19-2024
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-14-2022 |
Activity Feed
- Posted Re: Splitting data into different sourcetypes on All Apps and Add-ons. 07-23-2024 11:01 AM
- Posted Re: Splitting data into different sourcetypes on All Apps and Add-ons. 07-19-2024 06:59 AM
- Posted Splitting data into different sourcetypes on All Apps and Add-ons. 07-18-2024 03:27 PM
- Posted Re: What is the cause of this Buckets Error? on Splunk Enterprise. 02-02-2023 10:48 AM
- Posted What is the cause of this buckets error? on Splunk Enterprise. 02-01-2023 02:42 PM
- Posted If you need to create a new field alias that would be in two sourcetypes? on Getting Data In. 11-14-2022 01:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-23-2024
11:01 AM
We have it set to f5:bigip:syslog
... View more
07-19-2024
06:59 AM
They are coming into the HF through syslog UDP port.
... View more
07-18-2024
03:27 PM
Created the inputs in the local folder of the apps to use UDP on the heavy forwarder, set the sourcetype to f5:bigip:syslog, but the app is not splitting the data into multiple sourcetypes like it says it is supposed to. Can someone let me know what can be done to get this to work.
... View more
Labels
- Labels:
-
configuration
02-02-2023
10:48 AM
This is the index config that is throwing the warnings [fortinet] coldPath = $SPLUNK_DB/fortinet/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/fortinet/db maxDataSize = 307200 maxTotalDataSizeMB = 204800 thawedPath = $SPLUNK_DB/fortinet/thaweddb archiver.enableDataArchive = 0 bucketMerging = 0 bucketRebuildMemoryHint = 0 compressRawdata = 1 enableOnlineBucketRepair = 1 hotBucketStreaming.deleteHotsAfterRestart = 0 hotBucketStreaming.removeRemoteSlicesOnRoll = 0 hotBucketStreaming.reportStatus = 0 hotBucketStreaming.sendSlices = 0 metric.enableFloatingPointCompression = 1 metric.stubOutRawdataJournal = 1 minHotIdleSecsBeforeForceRoll = 0 rtRouterQueueSize = rtRouterThreads = selfStorageThreads = suspendHotRollByDeleteQuery = 0 syncMeta = 1 tsidxWritingLevel =
... View more
02-01-2023
02:42 PM
Have a index that is throwing up a warning, and the Root Cause says The newly created warm bucket size is too large. The bucket size=32630820864 exceeds the yellow_size_threshold=20971520000 from the latest_detected_index. This index was created just all the other indexes, and this one is the only one that is throwing the warning. And there has been at least 6 months of data be sent to this index, and it is saying there is only 14 days of data. What could be the issue with this index.
... View more
Labels
- Labels:
-
troubleshooting
11-14-2022
01:42 PM
I am getting conflicting information, so I just wanted to ask. If you need to create a new field alias that would be in two sourcetypes, do you need to create two different field aliases or just one.
... View more
Labels
- Labels:
-
sourcetype
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-19-2024
12:59 PM
|
