About divyavikas123

divyavikas123 · ‎02-21-2018

Hi locose , You can delete the older searchpeers,but you first need to stop splunk,and than delete and than start it.As searchpeer contains knowledge objects,and if those knowledge objects are still in use by your search heads(saved searches) than it will be replicated to indexers in the form of search bundles,So if you are having knowledge objects in search heads than u can delete it from search heads.So that next it wont get replicated to indexers.Ask me any query if not get fixed. Thank you.

divyavikas123 · ‎02-20-2018

Can we create a symlink in indexers for search peers bundles.

divyavikas123 · ‎02-20-2018

Suppose splunk is installed in the path called SPLUNK_HOME/etc/.... and the search peers bundles are located the SPLUNK_HOME/var/run/searchpeers.But always it gets fill which leads to stopping the indexer to index the data.so I want to create a symbolic link for that searchpeers bundles to other location(or drive),the path is abc/splunk.So that I should not get the space full due to search peers bundles again. 1) the search heads are in clusters and indexers are not? 2)Is it possible to create the symlink only for searchpeers to the path abc/splunk without any consequences? 2)will there be any problem related to anything after creating a symlink to searchpeers?

divyavikas123 · ‎06-12-2017

I placed set -x in vmstat , its showing only cpu,memory and disk but its not showing RAM value,please tell me if I need to modify any more things.

Posts	4
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-20-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Can we create a symbolic link for only search peer...

Re: How can I clean up "$splunk_home/var/run/searc...

Re: Mounted Bundle path - Search Head

Can we create a symbolic link for only search peer...

Re: Splunk App and Add-on for Unix and Linux: Why ...