Hi,   I'm having some architecture deployment issues on an indexer. When I check hosts using (index="_internal"  | stats count by host). I double-checked my outputs.conf on all my instances, I also checked the inputs.conf on indexer2 both are set to 9997 and I believe I have the right local IP running on all my instances but I still don't have any other host pop-up on Indexer2 except Indexer2. Any assistance would be highly appreciated. Side note I'm using AWS to practice setting up my own Architecture for learning purposes any help will be appreciated.   Regards, ... View more

Hi, If anyone can help it'll be greatly appreciated and ill pass on the karma. I keep getting this error when trying to add a search pair in the GUI: {"status": "ERROR", "msg": "Encountered the following error while trying to save: Peer with server name 192.168.118.128 conflicts with this server's name."}   When I add the search peer in the CLI it doesn't appear in the Search Peer section in the GUI either. Any help is gladly appreci ... View more

Hi, Is there any current instructions on how to disable this error message that I keep receiving. Where can I edit the conf file to disable this error. I'm currently learning on a few virtual machines using VMWare workstation and do not need a huge data limits in place just for training purposes.    "The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch."   ... View more

Hi,   If anyone can help me with this it would be truly helpful. I'm currently practicing to become a Splunk architect and I'm having an issue with file ownership on Linux Ubuntu. I changed Splunk's ownership to the dedicated Splunk account I created but it only changes that specific folder and not all the contents in it can anyone give me a cool little command to make everything under the Splunk folder owned by the Splunk account I created for Splunk management/ Regards,  ... View more

Hi, I heard that it's frowned upon to run Splunk on the root so I created a Splunk User. I can't figure out why I can't run Splunk start, stop, and status without getting permission denied. I've changed the ownership to for /opt/splunk to the user "Splunk" that I've created because I was told it was bad to run Splunk as root.  When working in my "Splunk" user account I continuously get this error whenever trying to config enable boot-start splunk. oot@cluster-master:/opt# ./splunk/bin/splunk enable boot-start -systemd-managed 1 -user splunk Warning: cannot create "/opt/splunk/var/log/splunk" Warning: cannot create "/opt/splunk/var/log/introspection" Warning: cannot create "/opt/splunk/var/log/watchdog" Systemd unit file installed at /etc/systemd/system/Splunkd.service. Configured as systemd managed service. root@cluster-master:/opt# su splunk splunk@cluster-master:/opt$ ./splunk/bin/splunk status Warning: cannot create "/opt/splunk/var/log/splunk" Warning: cannot create "/opt/splunk/var/log/introspection" Warning: cannot create "/opt/splunk/var/log/watchdog" Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied splunkd.pid file is unreadable. Pid file "/opt/splunk/var/run/splunk/splunkd.pid" unreadable.: Permission denied splunk@cluster-master:/opt$   ... View more

Hi, I've been learning Splunk on my free time and at the part of my lesson that is teaching me how to add a splunk index via the CLI. I think I made a mistake with either the stanza or the key values can someone possibly help me out with this one?   Splunk> 4TW Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Problem parsing indexes.conf: Cannot load IndexConfig: stanza=security Required parameter=homePath not configured Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue $   ... View more

Hi, I'm researching the Splunk Enterprise Environment and as of now I'm on "Architecture Optimization". I had a quick question for version 9.0.2 and that is how and what is the recommended Ulimit increase on Linux for optimization purposes? Regards, ... View more

Hi, I'm new to Splunk and maybe I didn't follow the instructions right from a post 2 years ago I'm trying to figure out how to reset my login credentials for the Enterprise Admin Console. Can someone possibly give me the correct updated solution? Regards, ... View more