Hi, The meaning of this message is that the indexers are busy, and the queues full. Therefore the internal splunk logs (like audit) are disabled in order to dedicate all the performance to the indexing. please check - apparently your Splunk instance is forwarding to itself. Check on the indexer: Is a receiving port set? [okay] Is the indexer forwarding? Where? If it is forwarding to itself, then that's the problem! You can find both of these settings in the UI under Settings>>Forwarding and Receiving Or, you can find the receiving settings in inputs.conf and the forwarding settings in outputs.conf Please accept this answer, it this pointed you in the right direction. ... View more

Hi @vicky05ssr If you only want the rest call way, Here is the query. | rest splunk_server=local servicesNS/nobody/SA-ITOA/itoa_interface/service fields="title,_key,kpis._key,kpis.title" Thanks ... View more

Thanks for your reply. I did try that, but no entries for servers in the output of above cmd. I have put the output of the above cmd below and also the settings from the GUI. The GUI shows the settings, but the conf file doesn't have it stored anywhere. GUI proof: CMD output : `[splunk@test_serverSH bin]$ ./splunk btool distsearch list --debug /opt/splunk/etc/system/default/distsearch.conf [bundleEnforcerBlacklist] /opt/splunk/etc/system/default/distsearch.conf [bundleEnforcerWhitelist] /opt/splunk/etc/system/default/distsearch.conf [distributedSearch] /opt/splunk/etc/system/default/distsearch.conf authTokenConnectionTimeout = 5 /opt/splunk/etc/system/default/distsearch.conf authTokenReceiveTimeout = 10 /opt/splunk/etc/system/default/distsearch.conf authTokenSendTimeout = 10 /opt/splunk/etc/system/default/distsearch.conf bestEffortSearch = false /opt/splunk/etc/system/default/distsearch.conf connectionTimeout = 10 /opt/splunk/etc/system/default/distsearch.conf disabled = false /opt/splunk/etc/system/default/distsearch.conf peerResolutionThreads = 0 /opt/splunk/etc/system/default/distsearch.conf receiveTimeout = 600 /opt/splunk/etc/system/default/distsearch.conf sendTimeout = 30 /opt/splunk/etc/system/default/distsearch.conf serverTimeout = 10 /opt/splunk/etc/system/default/distsearch.conf servers = /opt/splunk/etc/system/default/distsearch.conf shareBundles = true /opt/splunk/etc/system/default/distsearch.conf statusTimeout = 10 /opt/splunk/etc/system/default/distsearch.conf useSHPBundleReplication = true /opt/splunk/etc/system/default/distsearch.conf [replicationBlacklist] /opt/splunk/etc/system/default/distsearch.conf conf = (system|(apps/))/(default|local)/server.conf /opt/splunk/etc/system/default/distsearch.conf framework = apps/framework/... /opt/splunk/etc/system/default/distsearch.conf sampleapp = apps/sample_app/... /opt/splunk/etc/system/default/distsearch.conf user_specific_meta = users(/_reserved)?///metadata/local.meta /opt/splunk/etc/system/default/distsearch.conf [replicationSettings] /opt/splunk/etc/system/default/distsearch.conf allowDeltaUpload = true /opt/splunk/etc/system/default/distsearch.conf allowSkipEncoding = true /opt/splunk/etc/system/default/distsearch.conf allowStreamUpload = auto /opt/splunk/etc/system/default/distsearch.conf concerningReplicatedFileSize = 50 /opt/splunk/etc/system/default/distsearch.conf connectionTimeout = 60 /opt/splunk/etc/system/default/distsearch.conf maxBundleSize = 1024 /opt/splunk/etc/system/default/distsearch.conf maxMemoryBundleSize = 10 /opt/splunk/etc/system/default/distsearch.conf replicationThreads = 5 /opt/splunk/etc/system/default/distsearch.conf sanitizeMetaFiles = true /opt/splunk/etc/system/default/distsearch.conf sendRcvTimeout = 60 /opt/splunk/etc/system/default/distsearch.conf [replicationSettings:refineConf] /opt/splunk/etc/system/default/distsearch.conf replicate.app = true /opt/splunk/etc/system/default/distsearch.conf replicate.authorize = true /opt/splunk/etc/system/default/distsearch.conf replicate.collections = true /opt/splunk/etc/system/default/distsearch.conf replicate.commands = true /opt/splunk/etc/system/default/distsearch.conf replicate.eventtypes = true /opt/splunk/etc/system/default/distsearch.conf replicate.fields = true /opt/splunk/etc/system/default/distsearch.conf replicate.literals = true /opt/splunk/etc/system/default/distsearch.conf replicate.multikv = true /opt/splunk/etc/system/default/distsearch.conf replicate.props = true /opt/splunk/etc/system/default/distsearch.conf replicate.segmenters = true /opt/splunk/etc/system/default/distsearch.conf replicate.tags = true /opt/splunk/etc/system/default/distsearch.conf replicate.transactiontypes = true /opt/splunk/etc/system/default/distsearch.conf replicate.transforms = true /opt/splunk/etc/system/default/distsearch.conf [replicationWhitelist] /opt/splunk/etc/system/default/distsearch.conf other = (system|(apps/(?!pdfserver))|users(/_reserved)?//)/(bin|lookups)/... /opt/splunk/etc/system/default/distsearch.conf refine.conf = (system|(apps/)|users(/_reserved)?//)/(default|local)/.conf /opt/splunk/etc/system/default/distsearch.conf refine.metadata = (system|(apps/)|users(/_reserved)?//)/metadata/.meta /opt/splunk/etc/system/default/distsearch.conf searchscripts = searchscripts/... /opt/splunk/etc/system/default/distsearch.conf [tokenExchKeys] /opt/splunk/etc/system/default/distsearch.conf certDir = $SPLUNK_HOME/etc/auth/distServerKeys /opt/splunk/etc/system/default/distsearch.conf genKeyScript = $SPLUNK_HOME/bin/splunk, createssl, audit-keys /opt/splunk/etc/system/default/distsearch.conf privateKey = private.pem /opt/splunk/etc/system/default/distsearch.conf publicKey = trusted.pem [splunk@test_serverSH bin]$ ` ... View more

Thank you for your response, Sir. But what I could see is the Curl Command 1 seems to be executed , but the response for Curl Command 2 is still blank. Endpoint curl cmd 1 : search/jobs curl cmd 2: search/jobs/'$sid_id'/results' I created a new set of shell with a different end point this time (curl cmd 3: search/jobs and curl cmd 4: search/sid/summary) Curl Command 3 and Curl Command 4 both seems to be executed. So Now I feel its evident there is something to do with results endpoint ... View more