If you remove the read permission for that user role from the app permission, that user will no longer be able to select that app. ... View more

1. Make sure the UF is operating normally. $SPLUNK_HOME/bin/splunk status There should be no message other than the phrase is running. 2. Make sure that the log path you set in inputs.conf has a log 3. Make sure the inputs.conf settings are set correctly If you set the index, the index must be created in the indexer. 4. Check the UI of the indexer to see if the data is in. This method is more intuitive than checking with the inputs status of the cli. 5. Search index=_internal and search UF's IP to see if there are any problems Karma if this has helped! ... View more

Through the top command, we found that the Splunkd process is using 100% of the swap space. However, it is impossible to determine the root cause because there is no way to check exactly what kind of operation the swap space is using. Do you know anything about a case that solved the problem of using 100% of the swap space? Thank you. ... View more

I couldn't find any other cause and solution. I don't have any problems with Splunk operations, so I'm just using it.. ... View more

Let me tell you about the exact phenomenon. Splunk Enterprise is currently running two separate categories: search header server and index server. The server environment is as follows. OS version: CentOS 7 Splunk version: 9.0.4 ram: 256G swap: 16G I'm using about 5% of memory on average, but I'm using 100% of swaps. ... View more