Hi Woodcock How can i reach the splunk sales team? ... View more

Hi Miteshvohra splunk.license is the license i got only for extending a disk space from 500mb/day to 5gb/day and my trial period is still active. ... View more

hi MuS I am using splunk free, i head 5 hard warnings before when i was still under 500MB/day and the disk space now is 5GB/day after splunk.license file installation but i am still under violation, i can not do anything. ... View more

i am talking about syslog server ... View more

hi Mus i need your help. i did the calculations as you said and it worked perfectly i now know the disk space for my server but now since the company wants to assign me a syslog server for the splunk to use..they also want to know the Core CPU and RAM required for my server...is this important? if so please help how can i approach it to find the RAM and CPU required for my sever? thanks ... View more

thanks how can i save the disc space on my syslog sever lets say i just want to check and reset my logs in every 3 moths period in a sever...is that possible? ... View more

i am running a full splunk enterprise in a linux server that get logs from all switches. can you please elaborate more on your first line i dont understand it. thanks martin ... View more

Thanks Joe for your time i have i more question thou, as i want to monitor more than 100 network switches each under the same sourcetype but each switch obviously has unique host ip address is it possible to do like this below: [monitor:///var/log/H3C/information] disabled=false sourcetype=syslog_wisdom host=172.17.101.8 host=172.17.101.7 host=172.17.101.9 ... Thanks ... View more

i only see this inside my inputs.conf ... [monitor: ///var/log/H3C/information] disabled = false sourcetype = syslog_wisdom And i dont see any host value or do i have to just add the line like below after sourcetype... host = 192.168.1.254 ... View more

hi martin_mueller i always here this but i dont know why is not a good practice. can you please explain to me why is not a good practice in simple terms thank in advance ... View more

i get this [root@localhost wisdom.network_trainee]# strace /opt/splunk/bin/splunk start execve("/opt/splunk/bin/splunk", ["/opt/splunk/bin/splunk", "start"], [/* 39 vars */]) = -1 ENOEXEC (Exec format error) dup(2) = 3 fcntl(3, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE) fstat(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9bc4c17000 lseek(3, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) write(3, "strace: exec: Exec format error\n", 32strace: exec: Exec format error ) = 32 close(3) = 0 munmap(0x7f9bc4c17000, 4096) = 0 exit_group(1) = ? Thanks ... View more

Thanks Mus please advise me what to do from this point far because i feel like i am stacked 😞 thanks ... View more

hi Mus i find this : [root@localhost wisdom.network_trainee]# find /opt/splunk/ | wc -l 12750 [root@localhost wisdom.network_trainee]# du -sk /opt/splunk/ 1575340 /opt/splunk/ ... View more