We are getting alert from our LInux team stating high swap space observed for splunkd process on the Heavy forwarder which also acts as a syslog server . Below command is said to be consuming splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd   PID      USER PR  NI  VIRT           RES        SHR     S      %CPU  %MEM   TIME+     COMMAND 5580 splunk 20 0 4966352 878220 15516  S         57.8         5.4     5028:07   splunk   SWAP TOTAL = 4617084928 bytes SWAP USED = 4617084928 bytes   Please let me know what should be done to fix this issue . ... View more

Hi , While checking logs for a particular ubuntu  host , i am getting the below warm message on the internal logs  TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead Please suggest how to resolve this . Could this be the reason y device is not reporting to splunk  TcpOutputProc - Cooked connection to ip=x.x.x.x timed out   ... View more

Hi , While checking logs for a particular ubuntu  host , i am getting the below warm message on the internal logs  TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead Please suggest how to resolve this . Could this be the reason y device is not reporting to splunk  TcpOutputProc - Cooked connection to ip=x.x.x.x timed out     ... View more

Hi team, I m trying to find network traffic of a user and classify it as high or normal based on avg and stdev calculations QUERY : index="pan_logs" sourcetype="pan:traffic" user!=unknown | stats sum(bytes) as bytes by _time,user |eval MB = round(bytes/1024/1024,4)|bin span=1d _time | stats avg(MB) as avg stdev(MB) as stdv by user,_time|eval avg = round(avg,4) , stdv = round(stdv,4) | eval Volume_Type= if((avg+2*stdv)> MB , "HIGH" , "NORMAL However the avg and stdev calculation is wrong here as it collects per day basis and not when i keep it for last 7 days. ... View more