About mgoldoni

mgoldoni · ‎04-04-2023

Hello guys, I'm starting to approach ITSI, checking the machine learning associate to the prediciton analysis i saw that there are two algoritms (Regression and Classification) and based to the choise four methods: Linear regression (Regression) Random forest regressor (Regression) Gradient boosting regressor (Regression) Logistic regression (Classification) The prerequisite to use this function is the MLTK app that has more methods than the ones proposed by the configuration GUI. Is there a way to use different/additional alghoritm/method for the prediction ? If yes kindly can you suggest me how to do ? Thanks

mgoldoni · ‎03-27-2023

thanks for the answer. Setting RF 2:2 i get this error on splunkd.log 03-28-2023 12:47:53.255 +0700 ERROR ClusteringMgr - Failure to load cluster config (server.conf) Error = site_replication_factor={ origin:1, total:2 } is less than replication_factor=3. 03-28-2023 12:47:53.256 +0700 ERROR loader - clustering initialization failed; won't start splunkd Kindly can suggest me how to verify if an originating event from one of the peer in the dismissed site has been migrated. Using SPL with a simple query like "index=blabla "*<old-peer-name>*" doesn't give result. Regards

mgoldoni · ‎03-27-2023

Hello, needs to remive a site in a three sites cluster. Following the instructions in https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Decommissionasite, and resuming the commands as follow: - Check if cluster is in complete state - Move Manager away from the decommissioned site - Remove the peers in decommissioned site as receivers for UF - Enter in maintenance mode - Modify server.conf (manager node ) from: available_sites = site1, site2, site3 to: available_sites = site1, site2 from: site_replication_factor = origin:1,site1:1,site2:1,site3:1,total:3 to: site_replication_factor = origin:2,total:3 from: site_search_factor = origin:1, total:2 to: site_search_factor = origin:1,total:2 add: site_mappings = site3:site1 - Restart the manager - Disable maintenance mode - Stop splunk on each peer on the decommissioned site - Waiting the cluster back in complete state - Remove peers How can i verify if all is gone as expected ? check buckets, query ... Thanks

Posts	3
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-27-2023

Online Status	Offline
Date Last Visited	‎04-06-2023 03:24 AM

ITSI -Is there a way to use different/additional a...

Site decommission- how to find old data?

ITSI -Is there a way to use different/additional a...

Re: Site decommission- how to find old data?

Site decommission- how to find old data?