Thank you,  im gonna add the details from Slack for anyone else who might come across this.  "...Once a lookup exceeds the max memtable limit, Splunk will bucketify it, creating a kind of mini index." So if you're seeing index.alive or index.default just backlist the respective lookup in distsearch.conf and in rare circumstance you could increase max_mem_usage_mb in limits.conf ... View more

Thank you for the response. I am familiar with replicationblacklist, however my questions is what are index.default and index.alive doing in a lookup directory in a knowledge bundle. ... View more

converting UF to use service account seems to have fixed it for me. So if that's not possible at least you know that its a permissions issue with localsystem. ... View more

i have been looking for this for awhile. Thank you for putting in the leg work. ... View more

@ohignett if they use the kvstore yes, for example Stream. If you were to clean the kvstore you would lose all configurations for that app. In my experience very little apps use the kvstore in this manner. ... View more

@scannon4 $SPLUNK_HOME\var\lib\splunk\kvstore ... View more

im assuming you're on 8.x which uses python 3. That app does not support python 3 at this time. solutions are to wait until the app has a rewrite or downgrade splunk to 7.3.3. ... View more

@papaleo, you should really create a new post if you want an answer but ill go ahead and give you a nudge in the right direction. run ./splunk cmd btool inputs list --debug on one of your forwarders that still sending perfmon data. That will tell you all the input stanzas and where the config file for that stanza is. ... View more

i installed on my dev box and got the same results you did, i wasnt able to find 2.2.0 either. Have you tried to skip the prereq step? I'm sure it would be fine if you have check marks next to every other item. ... View more

i would make sure to read this How to move index buckets from one host to another If you want to retire a Splunk Enterprise instance and immediately move the data to another instance, you can move individual buckets of an index between hosts, as long as: When you copy individual bucket files, you must make sure that no bucket IDs conflict on the new system. Otherwise, Splunk Enterprise does not start. You might need to rename individual bucket directories after you move them from the source system to the target system. Roll any hot buckets on the source host from hot to warm. Review indexes.conf on the old host to get a list of the indexes on that host. On the target host, create indexes that are identical to the ones on the source system. Copy the index buckets from the source host to the target host. Restart Splunk Enterprise. use robo copy for windows rsync if you're using Linux ... View more

create a capture group like so | rex field=_raw "\s(?<name>.*)" | eval x=if(like(name,"%ã%"),1,0) | stats count by name ... View more

if you are referring to this https://splunkbase.splunk.com/app/3238/ its under format > general > legend > no ... View more

Where did you put this inputs.conf and did you restart the service after you created it? ... View more

ok so this is more of a not seeing forwarded data problem. first observation is you dont have an index defined. Not sure if that was a typo in your post or you dont have one in your stanza. If you dont have one in your input stanza I would check and see if your data is in index=main. ... View more

yes you can...http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf correct, but if this is an issue you need to create a blacklist to weed out some of the events you don't need and you wont need to increase this. without more details of what you are trying to do i cant give you an alternative. but if you are trying to use HEC or something similar, you should send the events to straight to the indexers. There are multiple ways to check forwarder status. Deployment server, check logs are being indexed with a search, get-service in powershell run a simple search using the host name field. Splunk keeps a fishbucket or a bookmark of where it left off so if you need to take the server down it will pick right back up. There is 0 difference in a hf and uf in this instance you can always set the forwarder to start on boot default on windows. see #4 or #5 to verify if working. a hf leaves a much larger footprint than a uf and in this scenario i don't see a reason to use a hf over a uf. There are very few reasons to use a hf over uf. ... View more

im a little confused on what youre wanting to do. Are you wanting to search within those 7 days that you have indexed or wanting to search older than seven days? ... View more

check your cron schedule maybe? also I would be looking in the db connect logs not the metric logs. Start here $SPLUNK_HOME\var\log\splunk_app_db_connect_audit_command.date.log ... View more

you might run chown -Rf splunk. /opt/splunk just to be sure. else you could try to clean the dispatch directory. ./splunk cmd splunkd clean-dispatch help should get you started ... View more

start with this index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by pool st | eval GBs=round(b/1024/1024/1024,2) | rename st as SourceType, GBs as "GB's Used" | fields SourceType "GB's Used" | sort - "GB's Used" ... View more