About katelynengel

katelynengel · ‎09-19-2016

I have a source that updates once a day. The fields are as follows: Field1, Field2, Field3, Field4, Field5 The next day, the source is slightly changed, and now the fields are coming in as follows: field1, Field2, Field3, Field4, Field5 How can I easily detect that the first field changed from Field1 to field1? When this happens, it breaks the dashboards that refer to Field1 (uppercase).

katelynengel · ‎09-16-2016

Need the ability to perform a hygiene check on certain data types by comparing fields & field quantities every time a new source is ingested for a particular sourcetype. This would be an extension of fieldsummary in a way, by showing fieldsummary over time and highlighting, for example if a field changes from FieldX to fieldX.

katelynengel · ‎10-09-2015

Thanks! I'll pass along to my team. 🙂

katelynengel · ‎10-09-2015

I meant Search Head Cluster but I would also be interested in the limit for an Indexer Cluster.

katelynengel · ‎10-08-2015

Is there a limit to how many Search Heads can be part of a Cluster? We have a fairly large deployment and I wanted to know if there is a max limit of the amount of SH's that can be part of any one cluster.

katelynengel · ‎02-06-2015

I know that the default Splunk settings do not allow you to set an html page as the Home Page default. I was wondering if there is a way around this as our Home Pages are html.

katelynengel · ‎05-13-2014

That still doesn't answer though why it works without the * if I | search.

katelynengel · ‎05-13-2014

There must be an invisible space in my lookup table because when I run the search as follows, it works as expected: index=index1 sourcetype=sourcetype1 bldg=XI*

katelynengel · ‎05-13-2014

I am trying to run the following search in Splunk: index=index1 sourcetype=sourcetype1 bldg=XI The bldg field is an automatic lookup field and exists in 100% of the events for index=index1 & sourcetype=sourcetype1. However, when I run this search, I only get back less then 1% of the results I would expect. When I run the search as follows, I get back all of the results I am looking for. index=index1 sourcetype=sourcetype1 | search bldg=XI Why do I need to pipe search to get the correct results? I am using Splunk 6.0.2

katelynengel · ‎02-21-2014

Did you ever figure out how to do this? I would be very interested in hearing about your solution.

katelynengel · ‎08-20-2013

The cluster master and cluster peers are fully set up and were successfully communicating. After upgrading all instances to 5.0.4, the cluster master is no longer able to successfully move configuration in cluster-apps on the cluster master to slave-apps on the cluster peers. Receive the following errors in splunkd.log: 08-20-2013 13:35:43.529 -0400 ERROR CMSlave - Failed to move bundle to slave-apps host=splunk-indexer6 Options| sourcetype=splunkd Options| source=/opt/splunk/var/log/splunk/splunkd.log 08-20-2013 13:35:43.528 -0400 ERROR CMSlave - Could not move /opt/splunk/var/run/splunk/cluster/remote-bundle/72329e457bf34d9351eb50a4dec40a85-1377020099/apps/_cluster to /opt/splunk/etc/slave-apps/_cluster

katelynengel · ‎07-18-2013

I am currently not able to search on my search heads. I am receiving the following WARN message in the splunkd.log. WARN DispatchCommand - Expected common latest bundle version on all peers after sync replication, found none. Reverting to old behavior - using most recent bundles on all. Currently, 2 peer indexers are full, but the other search heads are not receiving this same error and are still able to search.

Posts	12
Solutions	0
Karma Given	2
Karma Received	2
Member Since	‎04-09-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Does Splunk have the ability to determine if field...

Is there a limit to how many Search Heads can be p...

Is there a way to set an html page as the Home Pag...

My automatic lookup field is not searchable unless...

Cluster Master unable to send bundles to slave-app...

Splunk Dispatch Command WARN - unable to search on...

Re: Does Splunk have the ability to determine if f...