so I upgraded my Splunk version from 6.3.3 to 7.1.1, put it on a new server, split out the volumes on my server and the performance in my new environment is significant worse than my current production. The cpu is pegged out (100% resource consumption) I cannot get my dashboards to load in my new environment. We are on windows and do not have anything blocking the on-access scans but we did not have that in place in our current production environment either, so I don't understand why the performance is so much worse in our new environment. We loaded a lot of data into our system the past few days from re ingesting data (passed our daily limit) - not sure if that could be related. Any help or places to investigate first would be appreciated- thank you! ... View more

I was trying to load data via my auto index and I was getting a tail reader error because I think Splunk was reading in my file as a duplicate (this was at ~2 pm). Then around 9 pm- the file uploaded fine with all of the data. I checked _internal and the only information I have that contain the source file name are the below messages: -0400 INFO Metrics - group=per_source_thruput -0400 INFO LicenseUsage - type=Usage Does anyone know why file uploaded ~7 hours later and can help me troubleshoot? Thank you!! ... View more

Hello, I inherited my Splunk instance from the previous owner and they had built out all of their indexes/ dashboards in the search & reporting app. I want to have different permissions for indexes and dashboards so I need to transition all of my use cases into separate applications. One part I don't understand is where do all of the private dashboards/reports/searches of all my users live? Do they remain in the search & reporting app and it doesn't matter because they're private? ... View more

Hello, I think I have a problem where my auto index is uploading a file twice- the original file placed in the auto index directory and another file with the same name but with a combination of letters/number then .partial see below example.csv example.csv.XYZABC1.partial I need to figure out how to fix this problem- but I also want to determine if this partial file is the exact same as the original so I can delete it. Is there an easy way to run a search against two sources and compare all of the field values per field to see if they are the same and the file is the same? Thanks! ... View more

I have a group of users with their own role and app, and I want to restrict access for the Activity-> Jobs view for that role and app. I tried performing the below steps from this previously answered question but it did not lock down the access. Does anyone know how to help? Thanks https://answers.splunk.com/answers/203951/is-there-any-way-to-restrict-usersroles-from-acces.html?childToView=616667#answer-616667 I cloned the view job_management.xml from $SPLUNK_HOME/etc/system/default/data/ui/views/ into this location in my app "etc/apps/myapp/local/data/ui/views and then I set the permissions in etc/apps/myapp/metadata in the local.meta file And then I restarted my Splunk ... View more

I have a .csv that was dropped in an auto index folder and I am getting this error: -0500 ERROR TailReader - Ignoring path="X" due to: Bug during applyPendingMetadata, header processor does not own the indexed extractions conf I did not change my process (another file was dropped here this morning and it worked fine) and this file doesn't look any different- do you know why this is happening/how to fix? Thank you! ... View more