×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Ghostoverflow25
Engager
Member since: 2 weeks ago
Sunday
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎09-14-2025
View All

Splunk licensing pool warning not clearing

by in Getting Data In
Sunday
Sunday
Hi, I accidentally uploaded too much data on one day (a jsonl file) and violated the 500mb limit in place for the splunk enterprise trial. As such, it generated a pool warning: (info) Correct by midnight to avoid violation Learn more This pool contains peer(s) with 1 warning(s) splunk auto_generated_pool_download-trial download-trial pool_warning_count After UTC passed, it generated a "permanent" record with: Sep 29, 2025, 12:00:00 AM (2 hours ago) This pool has exceeded its configured poolsize=524288000 bytes. A warning has been recorded for all members splunk auto_generated_pool_download-trial download-trial pool_over_quota However, the first warning did not clear (the info one). Will i continue to receive permanent warnings from this, or can i simply leave it and not repeat my mistake? ... View more
Labels

Cannot get logs from specific source to seperate b...

by in Getting Data In
2 weeks ago
2 weeks ago
I have a source of logs that I want to ingest into splunk, where each line documents a seperate event. After having set it up, I noticed my old logs are not being ingested, so I ran: `/opt/splunkforwarder/bin/splunk spool /root/.local/share/HellPot/logs/HellPot_03_Apr_25_07-52_UTC.log -index hellpot` This however leads to multiple lines being detected as the same event in splunk. E.g.: 4/21/25 10:49:28.000 PM   {"level":"info","USERAGENT":"ct‑git‑scanner/0.4","REMOTE_ADDR":"<>","URL":"/.git/config","time":"2025-04-21T12:49:28Z","message":"NEW"} {"level":"info","USERAGENT":"ct‑git‑scanner/0.4","REMOTE_ADDR":"<>","URL":"/.git/config","BYTES":273794502,"DURATION":9992.439466,"time":"2025-04-21T12:49:38Z","message":"FINISH"} {"level":"info","USERAGENT":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36","REMOTE_ADDR":"<>","URL":"/cms/wp-includes/wlwmanifest.xml","time":"2025-04-21T14:15:29Z","message":"NEW"} {"level":"info","USERAGENT":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36","REMOTE_ADDR":"<>","URL":"/cms/wp-includes/wlwmanifest.xml","time":"2025-04-21T15:15:09Z","message":"NEW"} {"level":"info","USERAGENT":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36","REMOTE_ADDR":"<>","URL":"/cms/wp-includes/wlwmanifest.xml","BYTES":2174287196,"DURATION":4863712.933262,"time":"2025-04-21T15:36:32Z","message":"FINISH"} Whereas I'd expect each json line to be a different event. My props.conf has disabled line merging: ``` [default] SHOULD_LINEMERGE = false LINE_BREAKER = \n KV_MODE = json ``` And I both restarted the universal forwarder and ran `| extract reload=T` on my main instance. If I let the logs "trickle in" one by one it imports fine, with the caviet that it of course cannot include any of the prior data.   I'm kind of lost at this point on how to get the logs to properly separate, so would appreciate some guidance... ... View more
Contact Me
Online Status
Offline
Date Last Visited
Sunday