Can you please share how the connectivity issues are resolved? We are in the same situation and any help will be appreciated. ... View more

Hi callan, thanks for making our life easier with this app. I tried but could not install the app because of the following error - There was an error processing the upload.Invalid app contents: archive contains more than one immediate subdirectory: and ._uploader Splunk 6.6.2 regards Pramodh ... View more

Please check the fileupload app like the below - https://splunkbase.splunk.com/app/1707/ You can configure the path where the uploaded files will be stored and add it to your inputs.conf for monitoring ... View more

We made the following settings - Designated sh2 as captain, ad-hoc search head sh3 - ad-hoc search head. Our intent is to push all scheduled searches to sh1 and monitor the performance. We will keep you apprised on our observation. ... View more

We made the mistake of listing all the indexers through distsearch.conf and we started getting 3 copies of information. We later added the indexer master to SHs and it over-ruled the distsearch configuration. We have some searches where we read from previous scheduled searches a lot. We believe that SH in our case would fetch data from indexers, get data from artifacts and does the processing. ... View more

Yes DavidHourani. We have identical configuration on all the SHs ... View more

Hi DavidHourani, Thanks for your note. Our Three SHs have 36 CPU each. The skipping is seen only observed on Search Head Captain. We are observing skipping throughout the day. We have setup max_searches_per_cpu to 4 on all SHs already. (This is taking us closer to brink though) ... View more

We observed this behavior when searches are skipped. ... View more

We will try this and we will update you. ... View more

Thanks for your note. We are not using _TCP_ROUTING telnet Server2 9997 is working fine. ... View more

Sorry if we have not added sufficient details earlier. We wish to clone data to both the servers as they are QA and Prod respectively. ... View more

Our requirement is to clone data to both the servers. The servers are QA and Prod instances respectively. The surprising part is data is not reaching QA and as a work around we have setup forwarding from Prod to QA. ... View more

From the docs, if we give server list in comma separated fashion, the data will be load balanced between two receivers. Please confirm if my understanding is correct. # Specify a target group made up of two receivers. In this case, the data will # be distributed using AutoLB between these two receivers. You can specify as # many receivers as you wish here. You can combine host name and IP if you # wish. # NOTE: Do not use this configuration with SplunkLightForwarder. [tcpout:group3] server=myhost.Splunk.com:9997,10.1.1.197:6666 https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Outputsconf ... View more

Hi Mayurr98, the tcp connection from server2 to destination splunk server on ports 8089 and 9997 are working as expected. ... View more

thanks mayurr98. telnet is connecting. We are able to forward data to server 2 from another forwarder on another machine server 1 => forwarding the information that is what surprises us. We'll check the server side logs reg. forwarder. ... View more

Hi mayurr98, Thanks for the note. Here is the inputs.conf [monitor://d:\Carbynetech.csv] disabled=false index=indexname What surprises us is that data is getting forwarded to one server. We will do telnet test and report our findings. regards Pramodh ... View more