About andgarciaa

andgarciaa · ‎06-11-2024

Hello, I am using Splunk Cloud, for some our sourcetypes we have defined specific TRUNCATE values. I have a couple of questions. If `TRUNCATE` value is not defined for a sourcetype, what is the default limit of chars? Is there any guideline document or rules on how to define TRUNCATE? Especially if it is recommended to set something higher than 50k or 80k chars as a limit.

andgarciaa · ‎06-07-2024

Hello, We have some AWS accounts that use Firehose to forward logs from AWS to Splunk. A few days ago, I received a notification that the number of channels acquired started rapidly and hit the limit, since then we are not able to send logs any longer to Splunk. Splunk Support helped us to use a new Firehose endpoint, but we still see the ServerBusy because of the limited channels. Is there any option to monitor how our Streams are consuming the Channels and any advice you might have to improve this behaviour?

andgarciaa · ‎05-23-2024

One of my customers is using a tool with a rest API available via SAP ALM Analytics API Ref. https://api.sap.com/api/CALM_ANALYTICS/overview They are looking to get data from the API into a Splunk Index, so we suggest having an intermediary application (like a Scheduled Function) to get data from SAP and send it to Splunk using an HEC Token. Is it possible to use something at Splunk directly to pull the data from 3rd party? Or is the suggested approach a good idea to go?

andgarciaa · ‎05-13-2024

Hi @gcusello! I am using Splunk Cloud. I will check with Splunk Sales. The idea is because one of the users is looking to evaluate if is worthing (cost basis) to increase retention period for the usage of this data temporary instead of backing it up in another location. Thanks, Andrés

andgarciaa · ‎05-13-2024

If I have an index with a retention of 90 days. Can I make a rough estimate about the cost of increasing the retention of index= index-name extra 90 day?

Posts	5
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎05-13-2024

Online Status	Offline
Date Last Visited	‎09-27-2024 10:37 AM

TRUCANTE Logs

Identify usage of ack_channels

Splunk Index to pull Data from SAP ALM

Splunk Index Retention Cost

TRUCANTE Logs

Identify usage of ack_channels

Splunk Index to pull Data from SAP ALM

Re: Splunk Index Retention Cost

Splunk Index Retention Cost