Hello everyone,    I need  query to find out  sourcetype =gshshsh is using how much of data   1. From February month day wise usage.  and 2. From September to February month data  usage ... View more

Hello,  When I search for sour type=Xxx for last 60 min window , I found millions of records, so I tried to export , those millions of records in CSV format , and export and tried to download , within 30 sec , the page is showing me blank like this , any  information please . What might be the issue , please sujjest me .      ... View more

Hello everyone, When I was trying to search source type=... Xxx and checked from date from 3 /09/2021 to 6 /07/2021 it's showing me millions of records. And again I searched for 1 may 2021 to 25 July 2021 it's showing only 370 events , so  results are not  as we expected, it should be more. Please could you help me. Regarding this issue.   Thanks ... View more

Hello everyone, I have started using splunk enterprise from July , I have created hosts and forwarders for it , I think forwarders may not use data license ?, please give clarity on this.    but we didn't use it for still now and any logs also , but we can see that data license usage is very high  month to month August month 1.1m-->September--> 1.9m ---> October--> 2.8M . And why that's  happening please let me know , any process for this one , please provide some information , and how to check that one and how to find  who are using  that ,    Thanks ... View more

  Hello EveryOne , Please Help Me Regarding How to Remove Splunk Search heads From Splunk Master Or Cluster   We Have Some Splunk Dedicated Search Heads  In Our Environment. Ex: 15 Search Heads . In That 7 Search Heads Are Down, Because The Users Are Stopped Using Splunk Search Heads. . So Now We Are Planning To Remove Those 7 search  heads from our Splunk Master . What Is Procedure . could Anyone Explain Me In Manual Way. It Would Be Great. .   Please Also Check One Screen Shot I Have Shared . Find Below , We Need to Remove These Search Heads.     Regards ... View more

Hello All. In indexer clustering , one peer is not searchable  and status is down . What is the process to fix it please anyone help me  this is the big issue we are facing . ... View more

Hello Everyone,   I need Help. We have a trouble  in Splunk Cluster and I want to find out and investigate this is bad for our system and what will be the effects. please Help me out ... View more

We created new STG Splunk Alerts and enabled them starting July 27. The strange thing is that they cannot send emails to prj-sens-test@mail.rakuten.com and MS teams email 581e7bfc.OFFICERAKUTEN.onmicrosoft.com@apac.teams.ms for any new alert that happens.       Since we migrated to a new system, we cloned our old STG Splunk Alerts and then updated the name and also the sourcetypes for the new STG Splunk Alerts. Everything else, schedule, email recipient, subject and email message are the same. We have deleted the old STG Splunk Alerts. Our last email from STG Splunk Alert was on July 28, which was from the old Splunk Alert.       We are wondering why it suddenly stopped sending emails. May I ask if you have any ideas?    This is only an issue in STG Splunk. New alerts in PRD Splunk are not  working properly.       Our new alerts are here https://stg-asplunksrch101z.stg.jp.local/en-US/app/sens/alerts       This is for STG splunk with the following details:   User name: user_sens   Splunk host: https://stg-asplunksrch101z.stg.jp.local/   Group name: Ichiba Business Expansion Group   App team name: ibe   Service ID: 1013 ... View more

Hello everyone , Please can anyone help me out since last Friday 6/25 (or maybe earlier actually), some of our team members suddenly could not access Splunk search page. Team member: kandai.a.kitamura@rakuten.com takahiro.ito@rakuten.com Splunk search page: https://splunk.intra.rakuten-it.com/en-US/app/prov/search They got 404 after SSO. But other team members are still OK to access the search page. For example: ling.cao@rakuten.com ... View more