We are facing indexing delays we see the below error messages on heavuy forwarders. can some on suggest us   01-22-2022 07:32:15.845 +0000 INFO TailReader [9126 tailreader1] - ...continuing. 01-22-2022 07:32:10.845 +0000 WARN TailReader [9126 tailreader1] - Could not send data to output queue (parsingQueue), retrying... 01-22-2022 07:31:54.057 +0000 WARN TailReader [9124 tailreader0] - Could not send data to output queue (parsingQueue), retrying... 01-22-2022 07:31:49.056 +0000 INFO TailReader [9124 tailreader0] - ...continuing. 01-22-2022 07:31:44.056 +0000 WARN TailReader [9124 tailreader0] - Could not send data to output queue (parsingQueue), retrying... 01-22-2022 07:31:39.056 +0000 INFO TailReader [9124 tailreader0] - ...continuing. 01-22-2022 07:30:09.054 +0000 WARN TailReader [9124 tailreader0] - Could not send data to output queue (parsingQueue), retrying... 01-22-2022 07:29:59.053 +0000 INFO TailReader [9124 tailreader0] - ...continuing. 01-22-2022 07:29:49.053 +0000 WARN TailReader [9124 tailreader0] - Could not send data to output queue (parsingQueue), retrying... ... View more

Need help on procedure to generate  self signed certification on windows universal forwarder? ... View more

can any one help me with step by step ssl configuration from UF to HF and HF to Indexers?   Any help would be apprecitaed ... View more

Can any one suggest shall we upgrade splunk clustered environment from 8.0.3 to 8.2.2 ... View more

i have max results of 300000 in a report.But my shc is failing to send csv in a email. Please find the below settings.I tride to changed them to 300000 still its not working. Also i restarted after the change, Fyi:the report containing lesser then 175000 they are working perfectly fine. Can some one help me with this? $SPLUNK_HOME/etc/system/local/limits.conf [scheduler] max_action_results = 175000   [searchresults] maxresultrows = 175000   $SPLUNK_HOME/etc/system/local/alert_actions.conf   [default] maxresults = 175000 ... View more

i have 3 search heads and its on cluster.i just done rolling restart today morning i started seeing below error search mamber.using 8.2v ERROR SHCMasterHTTPProxy [1338 SHPHeartbeatThread] - Low Level HTTP request failure err=failed method=POST path=/services/shcluster/captain/members captain=blt14788005:8089 rc=0 actual_response_code=500 expected_response_code=201 status_line="Internal Server Error" transaction_error="<response>\n <messages>\n <msg type="ERROR">Cannot add peer=10.45.10.74 mgmtport=8089 (reason: removeOldPeer peer=3F2BAA5B-1792-4FE6-9393-499B8DAF8D33, serverName=blt14788004, hostport=10.45.10.74:8089, but found different peer=FD52AB8F-AF38-47E3-BDB6-C16D42E8AFB4 with serverName=blt14788004 and hostport=10.45.10.72:8089 already registered and UP)</msg>\n </messages>\n</response>\n"       ... View more

I have see below error messages in my search head cluster members .i am using 8.2v.can i get some resolution for this.   06-29-2021 08:54:29.880 +0100 ERROR SHCMasterHTTPProxy [5358 SHPHeartbeatThread] - Low Level HTTP request failure err=failed method=POST path=/services/shcluster/captain/members captain=blXXX:8089 rc=0 actual_response_code=500 expected_response_code=201 status_line="Internal Server Error" transaction_error="<response>\n <messages>\n <msg type="ERROR">Cannot add peer=XXXX mgmtport=8089 (reason: removeOldPeer peer=FD52AB8F-AF38-47E3-BDB6-C16D42E8AFB4, serverName=blt14788004, hostport=XX:8089, but found different peer=3F2BAA5B-1792-4FE6-9393-499B8DAF8D33 with serverName=XXXXX and hostport=10.45.10.74:8089 already registered and UP)</msg>\n </messages>\n</response>\n" ... View more

Hi all I am trying to generate web certificate for the below mentioned splunk domains. I would have done it for the single domain. But this is for multiple domains for the same host. can some one guide me correctly.   .     splunk-test.zone.xx.com splunk-test.rest.zone.xx.com Regards,shivanand ... View more

Hi all Some how splunk_essentials_8_2 directopry got removed from this directory /opt/splunk/etc/apps .later i replicated this directory from other instance.But i see the below error.can some one help with this. Validating installed files against hashes from '/opt/ee_splunk/splunk/splunk-8.2.0-e053ef3c985f-linux-2.6-x86_64-manifest' File '/opt/ee_splunk/splunk/etc/apps/splunk_essentials_8_2/default/app.conf' changed. Problems were found, please review your files and move customizations to local       ... View more

Hi All I have 4 indexer in cluster and 3 search heads in cluster, One master and 1 Deployer . Can some one help me to set up self signed  ssl communication in all instance. I  have read so many blogs but i didnt get the proper knowledge to deploye it . Can some one help with this.   generated successfully web based certifications.i do not have any issue with this        ... View more

Hi All,   We are planning to upgrade splunk forwarders with ansible. We observed that our forwarders are running on custom path and we cannot run splunk as root user .we were checking tar options but i am not understanding how we extract the tar file on custom path. can any one help with this?   Regards,Shivanand ... View more

Hi  All, Can you please help to understand the challenges on boarding auto-scaling application data into splunk on prem environment? we use intermediate forwarders.  ... View more