How we can get the health status of the HF,UF and IHF which are connected to DS while using the rest am able to see the health for the MC ,CM, LM,DS, Deployer and IDX etc but not able to get the status health which is in Red Yellow green and not getting . Rest which am using is - | rest /services/server/health on MC am able to see health status of  MC ,CM, LM,DS, Deployer and IDX but not for forwarders also while am running the same query opening any of the HF U.I am able to see there health results. ... View more

Is there is any query to check like if there is any fixup pending and also it shows SF , RF and data is searchable  in the cluster master . We can check in cluster master U.I but without going there is there anywhere this log are store so that we can fetch. I need to created a query which shows the status of SF, RF and searchable in Cluster Master also if there are any fixup pending. ... View more

Need help for the below Query  index=na sourcetype=na:co state=down host_state_type="HARD" [| tstats prestats=f values(host) as host_name WHERE index=df AND host!=1* | eval host_name=lower(host_name) | mvexpand host_name ] | stats count as DownMins by host_name |sort - DownMins|head 25 | addcoltotals label=Total labelfield=host_name While am running the query for last 24 hours its showing results but when I reduced the time range to less than 24 hours it's not showing any output but previously this query is running fine. Also while I run the query like -  It shows me output for last 24 hours   - index=na sourcetype=na:co state=down host_state_type="HARD" while I search the same host in  - index= df  host="ooo" Am getting the results while combining both not getting results less than 24 hours  Also I can see in the backend those host are down but not showing in Splunk query  ... View more

How can I export the host values in excel for the particular serverclass  Is there is any query for that that will be helpful . Path will be  Deployment server -> forwarder management ->serverclass -> action (edit clients) -> need to export the hostname from the list  ... View more

How can i find ulimit value/status for all server in monitoring console. ... View more

How to find the bucket status in the CLI  As I am using the below query :- ./splunk search "| dbinspect index=_internal span=1d" ... View more

After  Splunk forwarder version got upgrade from 9.0.5.0 to 9.3.1.0 windows server are having issue in forwarding the data to Splunk. Splunkd is stopping often in different server after restarting splund it start forwarding the data but issue comes again after 2,3 days  what actions to be taken to make the logs flow easily to Splunk   ... View more

How we can check the data coming to Splunk creating problem to CM making it unstable leading the peers to reach more than 2k+ and also RF and SF are red . ... View more

How Splunk admin give access for a service account AB-CDRWYVH-L. Access for-  Splunk API read write access ... View more