hi, I got the same Problem. so I solfed it with a password wich is short. my innitial password was 121 bit long, that doesn't work. could someone explain what the max bit of PW are? feel free to mark this post as usefull 😄 ... View more

please rate my answer 😄 many thanks and cheers ... View more

no, you don't Need this. please take a look @ here http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/ConfiguresearchheadwithCLI Edit the search head settings You can also use the CLI to edit the configuration later. Important: When you first enable a search head, you use the splunk edit cluster-config command. To change the search head configuration, you must instead use the splunk edit cluster-master command. For example, to change the security key (secret), use this command: splunk edit cluster-master https://10.160.31.200:8089 -secret newsecret123 Important: The splunk edit cluster-master command always takes the current master URI:port value as its initial parameter. For example, this command connects the search head to a different master by setting a new value for the -master_uri parameter, but it provides the value for the old master as its initial parameter: splunk edit cluster-master https://10.160.31.200:8089 -master_uri https://10.160.31.55:8089 Refer to the CLI clustering help, along with the server.conf specification file, for the list of configurable settings. ... View more

Hi, I think it depends If your Cluster Is a multisite Cluster, that means you work wit site1 and site2. If you are not sure, post your SH-Cluster conf cheers ... View more

you are right, there no data with this key-value pair i.e. user=value many thanks for your support! ... View more

yes runs in verbose mode, and use environment data of hadoop (just a other team) ... View more

thanks for the TIP, so I agree that the saved search is there, but why the following line doesn't work? index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appId=* | top finalStatus when I' looking for "index=hadoopmon_metrics sourcetype=hadoop_resourcemanager" there no field extractions just like "appId" do you have data in your test inv? cheers, and so sry for downvoting ... View more

I downvoted this post because not helpful, because it doesn't make sense when i'm looking for using the preinstalled frondend. there searches like [yarn top user] index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appid=*| top limit=20 user [yarn success rate] index=hadoopmon_metrics sourcetype=hadoop_historyserver user=* | eval elapsedtime = finishtime - submittime| table jobname queue user nummaps numreduces status elapsedtime etc ... View more

where i can find the props.conf for sourcetype like: # hadoop_datanode # hadoop_namenode # hadoop_historyserver ... View more

hi, do you find a Workaround? many thanks in advance ... View more

Hi, try my Workaround, thats worked for me very well. doublecheck the instanzename in $SPLUNK_HOME/etc/system/local/server.conf (same as Hostname) then click on >SETTINGS>MONITORING_CONSOLE MONITORING_CONSOLE is showing ---click SETTINGS >GENERAL_Setup ---THIS instance Instance (host) = hostname value, etc on the top, press "apply changes" verify "YES" (maybe etdit roles temporärly) IMPORTANT press REFRESH doublecheck Overwie on MC DONE! ... View more

it is also very important to apply the changes by MC (button in the top right) ... View more

many thanks, solution is right @ aaraneta ...and you are hosting the DMC on an instance other than the cluster master, you must add the cluster master as a search peer. Works very well! ... View more

you need min 3 member of SH clustering, also the member needs to be the same setup. the context of 3 member is to collect a "Captain" role of your shcluster. make sure your member can connect to the clustermaster and deployer, additional to the deploymentserver try to fix your quest as following: setup a new SH member clean your xx/local/server.conf with all [shcluster] content only on your SH MEMBER! -->rm -rf SPLUNK_HOME /etc/instance.cfg -->rm -rf /SPLUNK_HOME/var/run/splunk/_raft/* --> ./splunk restart now build your fresh SH Cluster with on all sh member -->./splunk edit cluster-config -master_uri https://xx.xx.xx.xx:8089 -mode slave -site site1 -replication_port 8080 -secret your choice restart -->./splunk init shcluster-config -mgmt_uri https://your.sh.member.DNS or IP:8089 -replication_port 8080 -secret changed -->./splunk bootstrap shcluster-captain -servers_list https://member1:8089,https://member2:8089,https://member3:8089 don't forget to click solfed 🙂 additional links: http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCconfigurationoverview hope it helps ... View more

hi, so I'm know is it is a late tra to answer, but ig ot the same issue. in my case I fixed as following. make sure that the member have connection to the deployer, and clustermaster as well. List item for me works : ::remove all "shcluster entries" at SPLUNK_HOME/etc/system/local/server.conf ::rm -rf /SPLUNK_HOME/etc/instance.cfg ::rm -rf /SPLUNK_HOME/var/run/splunk/_raft/* restart splunk, done now you can join or whatever you are looking for additional links: https://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/Handleraftissues http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/Removeaclustermember http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/SHCconfigurationoverview ... View more

for me works as folowing. index="XXX" sourcetype="XXX" source=XXXX Host="10.*" Risk_Factor!="None" | stats cont by Risk_Factor | sort by -Risk_Factor |head 3 "| some statistic" .. done, so I'm Know that I'm very late, but it works ... View more

in my case, was the solution etit policy. just like the documentation (http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setlimitsondiskusage) and also http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setaretirementandarchivingpolicy -->Set a retirement and archiving policy ... View more

hi, i got the same Issue. for me works following workaround. doublecheck the instanzename in $SPLUNK_HOME/etc/system/local/server.conf (same as Hostname) then click on >SETTINGS>MONITORING_CONSOLE MONITORING_CONSOLE is showing ---click SETTINGS >GENERAL_Setup ---THIS instance Instance (host) = hostname value, etc on the top, press "apply changes" verify "YES" (maybe etdit roles temporärly) IMPORTANT press REFRESH doublecheck Overwie on MC DONE! ... View more