About Yod_ssoni

Yod_ssoni · ‎08-26-2019

Hi, Please help me as i would like to know if there is any limit on how many db input connections that i can configure in one heavy forwarder using Splunk DB connect app. Thank you in advance!

Yod_ssoni · ‎05-19-2019

Hi @tomawest, I am facing similar situation where I am trying to extract events from newrelic addon and unable to perform line break for JSON lines from single event to multiple events. Could you please help me explain with stanza configuration and how it is done like which conf file and what stanza i need to add JSON path $.[*] ? Thanks, Shashank Soni

Yod_ssoni · ‎02-24-2019

Hi All, Can you please help us to find if there is there possibility in splunk db connect 3.0 two join two tables from two different connections at data input level or next. But it should return all 3 lakh records back in the results. Thanks in advance!

Yod_ssoni · ‎12-12-2018

Hi All, We would like to move our existing master server instance(which acts as License master, DMC, Cluster Master, Search Head Deployer as well as Deployment server) to another new instance having same IPaddress and hostname due to underlying physical server issues. Can anyone provide or validate with the list of steps for an optimal way of doing this without disturbing the existing environment? Here are the following steps I found to perform given as per the documentation for migrating Splunk instance you have provided- In our case: *1. We will stop the splunk master first. 2. Rename the new instance host-name and ipaddress same as master. 3. Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host. 4. Install the appropriate version of Splunk Enterprise for the target platform. 5. Start Splunk Enterprise on the new instance. 6. Log into Splunk Enterprise with your existing credentials * Will this help in case of current scenario, because my current master has following roles (which acts as License master, DMC, Cluster Master, Search Head Deployer as well as Deployment server)??

Yod_ssoni · ‎03-20-2018

Due to increase in Splunk Data usage, we have deployed new cluster and planning to migrate few indexes to new cluster. I have checked in internet but did not find any link which show the clear steps to migrate indexed data to new cluster. Can anyone please provide the clear steps for migration. Please find below details - Splunk Version is same in both cluster - 6.6.2 V Existing Index Cluster - 8 Node cluster New Index Cluster - 3 Node cluster Need to migrate 7 Indexes from 8 node cluster to 3 node cluster. Thanks, Shashank Soni.

Yod_ssoni · ‎07-31-2017

Does machine learning app collect data from servers using UF or we need to write our own data collection logic and feed data into splunk and than we can use ML app ?

Yod_ssoni · ‎05-02-2017

Hi, Today morning 2 search heads out of 3 from cluster went down. When i checked it killed by OS with message 'out of memory' in /var/log/message, but system had enough memory at that time when splunk process got killed by OS [around 38% was free]. In splunkd.log file i did not find any error messages. Can any one please let me know how to get the root cause of this issue and fix it. This already happen 3-4 times. Thanks in advance. thanks, Shashank Soni.

Posts	7
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎05-02-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Maximum Limit of db inputs in heavy forwarder usin...

Splunk DB connect 3: left Join two tables from dif...

Can anyone help me with the steps to move a Splunk...

Migrate Index data from old cluster to new cluster

Machine learning app in splunk

Splunk process killed by OS [out of memory] in Sea...