Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ykpramodhcbt
ykpramodhcbt
Path Finder
Member since:
10-06-2017
06-05-2020
Community Statistics
| Posts | 31 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 3 |
| Member Since | 10-06-2017 |
Activity Feed
- Karma Related to tokens in multiselect for harishalipaka. 06-05-2020 12:49 AM
- Karma Re: Search Head Cluster - Scheduled Search Running only in one instance for harsmarvania57. 06-05-2020 12:49 AM
- Karma Re: summary indexes + metrics in Splunk 7.0.0 for esix_splunk. 06-05-2020 12:49 AM
- Got Karma for Search Head Cluster - Scheduled Search Running only in one instance. 06-05-2020 12:49 AM
- Got Karma for Maximum Number of Concurrent Running Jobs Search Head Cluster Error. 06-05-2020 12:49 AM
- Karma Re: Did 6.5.4 introduce new concurrency limits? for sloshburch. 06-05-2020 12:48 AM
- Got Karma for Re: Why do I see several search peer errors such as "peer has status="Down"" when my peers are running?. 06-05-2020 12:48 AM
- Karma Re: What is the default REST API URL to post data to the default index? for birarich. 06-05-2020 12:47 AM
- Karma Re: How Do I Create a Summary Index in a Search Head Cluster? for javiergn. 06-05-2020 12:47 AM
- Karma Re: loadjob: what should be the user for a saved search whose owner is "No owner"? for tonopahtaos. 06-05-2020 12:46 AM
- Karma Re: Enormous data duplication for Ayn. 06-05-2020 12:46 AM
- Karma Re: Summary indexing impact on license volume for the_wolverine. 06-05-2020 12:45 AM
- Posted Index Cluster - Backup stratetegy on Deployment Architecture. 08-21-2018 12:30 AM
- Tagged Index Cluster - Backup stratetegy on Deployment Architecture. 08-21-2018 12:30 AM
- Tagged Index Cluster - Backup stratetegy on Deployment Architecture. 08-21-2018 12:30 AM
- Posted Re: Why do I see several search peer errors such as "peer has status="Down"" when my peers are running? on Dashboards & Visualizations. 08-08-2018 01:13 AM
- Posted Additional indexed fields on Knowledge Management. 07-25-2018 08:35 AM
- Tagged Additional indexed fields on Knowledge Management. 07-25-2018 08:35 AM
- Tagged Additional indexed fields on Knowledge Management. 07-25-2018 08:35 AM
- Tagged Additional indexed fields on Knowledge Management. 07-25-2018 08:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
08-21-2018
12:30 AM
Hi All,
We have 3 indexers in a Index cluster with a Index master. Currently, the data is being backed up periodically to AWS S3/Glacier storage.
We want to understand if we need to shutdown before we backup the buckets
Reviewed this http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Backupindexeddata
... View more
08-08-2018
01:13 AM
1 Karma
Can you please share how the connectivity issues are resolved?
We are in the same situation and any help will be appreciated.
... View more
07-25-2018
08:35 AM
Splunk generally index data based on _time.
We have a use case where we want to retrieve results from summary index based on the batchid field. Can you please let us know what is the best way to achieve that scenario?
... View more
03-07-2018
11:28 AM
Hi callan,
thanks for making our life easier with this app.
I tried but could not install the app because of the following error -
There was an error processing the upload.Invalid app contents: archive contains more than one immediate subdirectory: and ._uploader
Splunk 6.6.2
regards
Pramodh
... View more
03-07-2018
11:06 AM
Please check the fileupload app like the below -
https://splunkbase.splunk.com/app/1707/
You can configure the path where the uploaded files will be stored and add it to your inputs.conf for monitoring
... View more
12-30-2017
04:50 AM
Hi Splunkers,
We are evaluating moving to metrics events for our existing apps. In our apps, we have to display the latest value of the corresponding tag by time.
From documentation, we find that we might not be able to do it
Source: https://docs.splunk.com/Documentation/Splunk/7.0.1/Metrics/Search
1. You cannot search metrics data for individual metric events.
2. You cannot use automatic lookups with metrics data. This is because automatic lookups are applied to individual events, whereas metrics are analyzed as an aggregate.
Please suggest if there are any work-arounds.
... View more
12-23-2017
11:13 AM
We made the following settings -
Designated sh2 as captain, ad-hoc search head
sh3 - ad-hoc search head.
Our intent is to push all scheduled searches to sh1 and monitor the performance. We will keep you apprised on our observation.
... View more
12-23-2017
10:36 AM
We made the mistake of listing all the indexers through distsearch.conf and we started getting 3 copies of information. We later added the indexer master to SHs and it over-ruled the distsearch configuration.
We have some searches where we read from previous scheduled searches a lot. We believe that SH in our case would fetch data from indexers, get data from artifacts and does the processing.
... View more
12-23-2017
06:45 AM
Yes DavidHourani.
We have identical configuration on all the SHs
... View more
12-23-2017
04:07 AM
Hi DavidHourani,
Thanks for your note.
Our Three SHs have 36 CPU each. The skipping is seen only observed on Search Head Captain. We are observing skipping throughout the day.
We have setup max_searches_per_cpu to 4 on all SHs already. (This is taking us closer to brink though)
... View more
12-22-2017
12:56 PM
We observed this behavior when searches are skipped.
... View more
12-22-2017
12:18 PM
Hi Splunkers,
We have a Search Head Cluster with 3 search heads. We have 70 searches that are supposed to run every minute.
We find that 14-15% of searches are getting skipped on SH Captain. We tried to change the captain and observed the same phenomenon on new captain too. We do not have any SH designated for ad-hoc searches.
Please find the image below where other search heads are not experiencing any skip. Also, note that SH captain is taking higher number of searches.
Please let us know if there is a way to get around this.
... View more
12-20-2017
09:44 PM
Thanks for your note.
We are not using _TCP_ROUTING
telnet Server2 9997 is working fine.
... View more
12-20-2017
09:41 PM
Sorry if we have not added sufficient details earlier. We wish to clone data to both the servers as they are QA and Prod respectively.
... View more
12-20-2017
09:38 PM
Our requirement is to clone data to both the servers. The servers are QA and Prod instances respectively.
The surprising part is data is not reaching QA and as a work around we have setup forwarding from Prod to QA.
... View more
12-20-2017
08:39 PM
From the docs, if we give server list in comma separated fashion, the data will be load balanced between two receivers. Please confirm if my understanding is correct.
# Specify a target group made up of two receivers. In this case, the data will
# be distributed using AutoLB between these two receivers. You can specify as
# many receivers as you wish here. You can combine host name and IP if you
# wish.
# NOTE: Do not use this configuration with SplunkLightForwarder.
[tcpout:group3]
server=myhost.Splunk.com:9997,10.1.1.197:6666
https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Outputsconf
... View more
12-20-2017
05:28 AM
Hi Mayurr98, the tcp connection from server2 to destination splunk server on ports 8089 and 9997 are working as expected.
... View more
12-16-2017
11:00 AM
thanks mayurr98. telnet is connecting.
We are able to forward data to server 2 from
another forwarder on another machine
server 1 => forwarding the information
that is what surprises us.
We'll check the server side logs reg. forwarder.
... View more
12-16-2017
05:54 AM
Hi mayurr98,
Thanks for the note.
Here is the inputs.conf
[monitor://d:\Carbynetech.csv]
disabled=false
index=indexname
What surprises us is that data is getting forwarded to one server. We will do telnet test and report our findings.
regards
Pramodh
... View more
12-16-2017
04:42 AM
We have a single data source from which we want to forward clone data to - splunk server 1(prod) and splunk server 2(qa).
The data seems to go to splunk server 1 fine but doesn't get forwarded to splunk server 2. We don't anything wrong in the log file too.
splunk list forward-server lists both the servers
outputs.conf (Windows Forwarder)
[tcpout]
defaultGroup=awsprod,awsdev
[tcpout:awsprod]
server=<server1-ip>:9997
useACK = true
[tcpout:awsdev]
server=<server2-ip>:9997
useACK = true
As a work around, we have put a forward stanza on splunk server 1(prod) to forward data to splunk server 2(qa) and it seems to work fine.
When we try to forward data from other machines to server2 (qa), it seems to work fine.
Any suggestions are highly appreciated.
PS: More details on cloning and server details - qa/prod added.
... View more
12-11-2017
09:53 PM
1 Karma
Hi,
We have a search head cluster with 3 search heads -
We are seeing the following message and a decent skip ratio on DMC.
priority=default, status=skipped, reason="The maximum number of concurrent running jobs for this historical scheduled search on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_cluster-wide", concurrency_limit=1
This might be the way it is designed to run searches - only in one search head at a given time. If it turns out to be a bug, please mention how we can fix this.
regards
Pramodh
... View more
12-04-2017
09:39 PM
Hi, It is helpful.
Can you please let us know how we can figure out which search head picked up a scheduled search?
Currently we are running the following command on all seach heads -
$ cat splunkd.log | grep "searchname"
... View more
12-04-2017
05:55 AM
Thanks for sharing your insights.
Yes, that is one test we are running. Open from both ELB and Proxy and see where the timeout is happening.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
