About prasireddy

prasireddy · ‎09-29-2023

Hi Team , In my Splunk Environment(Universal Forwarder) after updating SSL certificate I'm getting these error in Splunk UI how can I overcome this error. I'm attaching screenshots here please could you help on this ?

prasireddy · ‎08-18-2023

Hi @isoutamo , Thank you. I will check. Moreover, it not a clustered Env we have only 2 indexers,1 license master and 1 search head. And I have attached the file, please could explain this paths, retention policies and bucket configurations from the screen shot. thanks, in advance.

prasireddy · ‎08-18-2023

Hi @richgalloway Please could explain this paths, retention policies and bucket configurations from the screen shot. Thanks, Praseeda

prasireddy · ‎08-18-2023

Hi @richgalloway, Hi @richgallowayrichgalloway, Actually, when I check in Setting-->Monitoring console--->Indexing--->Indexes and volumes---->Index Details: Instance but here in buckets I didn't see anything for the same I'm attaching screen shot. Please could you explain once?

prasireddy · ‎08-17-2023

Hi Team, I wanted to know what the default retention period of buckets in Splunk i.e. (HOT, WARM, COLD, FROZEN, THAWED). How can I know the retention period of each bucket and where can check the retention period of each bucket? please could you help me with the location or path of each bucket's configurations in Splunk. Actually, I'm new to these bucket concepts. we have only 2 indexers ,1 license master and 1 search head. Thanks, Praseeda.

prasireddy · ‎08-10-2023

Hi @PickleRick ; I have used dbinspect command but here I need sourcetype and even the total count and size of command_type="METER_ALERT" and NON "METER_ALERT" separately . Query : index=service_audit sourcetype=SMWAN command_type !="METER_ALERT" |eval size=len(_raw) | eval raw_len_KB= size/1024 | eval raw_len_MB = size/1024/1024 | eval raw_len_GB = size/1024/1024/1024 | table size,raw_len_KB,raw_len_MB ,raw_len_GB,index | stats count sum(size) as Bytes sum(raw_len_KB) as KB sum(raw_len_MB) as MB sum(raw_len_GB) as GB by index

prasireddy · ‎08-07-2023

I will check come back thank you so much

prasireddy · ‎08-07-2023

Hi , I have checked indexex.conf but here I did not find Retention option like "frozenTimePeriodInSecs". then it means default is 6years . Even when I'm giving 6 yr periods I did not see the data why ?

prasireddy · ‎08-07-2023

Yes, For shorter periods it is working fine. How can I check retention time grater than seven years and it is not a summary index . Please could you help on this

prasireddy · ‎08-07-2023

Hi Team, how can I check 7 years old data that means the first ingestion was on 26 dec of 2016 I need total data size from starting date to Jun 30 2023. I have tried with following Query ,when I run that its showing some 1."DAG Execution Exception Error ":search has cancelled 2.search Auto-cancelled the Query which I have used index=wineventlog source=security command_type!="METER_ALERT" |eval size=len(_raw) | eval raw_len_KB= round(size/1024,3) | eval raw_len_MB = round(size/1024/1024,3) | eval raw_len_GB = round(size/1024/1024/1024,3) | table size,raw_len_KB,raw_len_MB ,raw_len_GB,index | stats count sum(size) as Bytes sum(raw_len_KB) as KB sum(raw_len_MB) as MB sum(raw_len_GB) as GB by index please help on this ? Thanks In Advance Bala

Posts	10
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎08-07-2023

Online Status	Offline
Date Last Visited	3 weeks ago

Ssl cert update

What is Splunk buckets default retention period?

how can I check 7 years of old data from splunk?

Ssl cert update

Re: Splunk buckets default retention period

Re: Splunk buckets default retention period

Re: Splunk buckets default retention period

What is Splunk buckets default retention period?

Re: how can I check 7 years of old data from splun...

Re: how can I check 7 years of old data from splun...

Re: how can I check 7 years of old data from splun...

Re: how can I check 7 years of old data from splun...

how can I check 7 years of old data from splunk?