Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Mayurmpatil
Mayurmpatil
Path Finder
Member since:
10-18-2017
06-05-2020
Community Statistics
| Posts | 26 |
| Solutions | 5 |
| Karma Given | 3 |
| Karma Received | 5 |
| Member Since | 10-18-2017 |
Activity Feed
- Karma Re: How to disable monitoring console using command line. for jawaharas. 06-05-2020 12:50 AM
- Karma Re: Creating an index: New Index Max Size vs Retention for aohls. 06-05-2020 12:50 AM
- Got Karma for How do I add or create license pools with a set of servers on a license master via CLI or by editing the server.conf file?. 06-05-2020 12:50 AM
- Got Karma for Re: inputs.conf monitor stanza for Windows Universal Forwarder with wildcards not working. 06-05-2020 12:50 AM
- Got Karma for Re: Creating an index: New Index Max Size vs Retention. 06-05-2020 12:50 AM
- Got Karma for Re: Deployment Server permission server/apps in multi team environment.. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk Admin certification exam prep. 06-05-2020 12:50 AM
- Karma Where to configure global permissions for app for tbalouch. 06-05-2020 12:46 AM
- Posted Re: High CPU on my Splunk BOX on Monitoring Splunk. 08-21-2019 05:37 AM
- Posted Re: Has anyone setup a data input for Samanage API calls? on Getting Data In. 08-19-2019 08:01 PM
- Posted Re: Splunk Admin certification exam prep on Training + Certification Discussions. 08-19-2019 12:55 AM
- Posted Re: Heavyforwarder in HA on Deployment Architecture. 08-19-2019 12:51 AM
- Posted Re: Cluster and Non-cluster Indexer on Deployment Architecture. 08-18-2019 10:06 PM
- Posted Re: Deployment Server permission server/apps in multi team environment. on All Apps and Add-ons. 08-18-2019 09:22 PM
- Posted Re: How to send data to a custom index which is currently being sent to main index? on Getting Data In. 08-18-2019 09:19 PM
- Posted Re: Creating an index: New Index Max Size vs Retention on Knowledge Management. 08-18-2019 09:06 PM
- Posted Re: Creating an index: New Index Max Size vs Retention on Knowledge Management. 08-14-2019 06:32 AM
- Posted Re: inputs.conf monitor stanza for Windows Universal Forwarder with wildcards not working on Getting Data In. 08-14-2019 03:55 AM
- Posted Re: Is my splunk healthy? daily admin procedure wanted on Knowledge Management. 08-12-2019 04:56 AM
- Posted Re: Is my splunk healthy? daily admin procedure wanted on Knowledge Management. 08-12-2019 04:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-21-2019
05:37 AM
Go to monitoring console and Run the health check script. it will show you what is the issue.
... View more
08-19-2019
08:01 PM
Try with below add-on.
https://splunkbase.splunk.com/app/1546/#/details
... View more
08-19-2019
12:55 AM
1 Karma
This link will give you all the information.
https://www.splunk.com/en_us/training/program-guide.html
Splunk sayds take below training for becoming a splunk admin :
Splunk Fundamentals 1
Splunk Fundamentals 2
Splunk Enterprise System Administration
Splunk Enterprise Data Administration
Troubleshooting Splunk Enterprise
Splunk Enterprise Cluster Administration
Implementing Splunk SmartStore
Splunk Workload Management
Working with Metrics in Splunk
... View more
08-19-2019
12:51 AM
If you want install app like db connect on HF , then you will have to install it only on one HF.
Generally , I keep all my apps on one HF and other HF for receiving events for UF.syslog,HEC,fuentd..
... View more
08-18-2019
10:06 PM
Obviously go with clustered indexers for high availability and disaster recovery. also it depends on your requirement as well.
Use below document which shows the key difference .
https://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Keydifferences
... View more
08-18-2019
09:22 PM
1 Karma
No. I don't think this is possible .
Splunk has given serverclass.conf for it . we can easily segregate the apps / configs from hosts.
Would be better if splunk centralize team only uses deployment server. else you will mess up one day.
... View more
08-18-2019
09:19 PM
Hello @amulay26 - may be there is one more inputs.conf in some other app or system local in your splunk enterprise.
with below command please find it.
/opt/splunk/bin/splunk cmd btool inputs list --debug | grep index
you will get all the inputs.conf files splunk is using in you environment .
... View more
08-18-2019
09:06 PM
@aohls - can you up vote my answer if you have happy with it.
... View more
08-14-2019
06:32 AM
1 Karma
If maxTotalDataSizeMB(index size) is reached before frozenTimePeriodInSecs(retention period), data will be rolled to frozen before the configured time period has elapsed. If archiving has not been configured, unintended data loss can occur.
also if frozenTimePeriodInSecs(retention period) is reached before the index size of 5 gb is not reached , data will be rolled to frozen.
so in theory whatever reaches first will be applicable.
... View more
08-14-2019
03:55 AM
1 Karma
[monitor://D:\Log\App*\Log*.log]
disable = 0
use below document
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Monitorfilesanddirectorieswithinputs.conf
you are using m in caps(M)
... View more
08-12-2019
04:56 AM
https://splunkbase.splunk.com/app/3796/
Enable the alerts in this app. Up vote the answer if you like it.
... View more
08-12-2019
04:47 AM
Splunk had one inbuilt.
Find the health check at Monitoring Console > Health Check. Start the health check by clicking Start.
It will give you many details you require
... View more
08-12-2019
02:49 AM
check the inputs.conf on indexers and outputs.conf on non-indexers.
On indexers:
[splunktcp://9997]
disabled = 0
On non-indexers:
[indexAndForward]
index = false
[tcpout]
defaultGroup = indexing_cluster
forwardedindex.filter.disable = true
indexAndForward = false
[tcpout:indexing_cluster]
server=:9997,:9997
Login to the server on which you have enabled monitoring console . go to settings > monitoring console > health check .
run this script . Please note before running the health check script before configure monitoring console as distributed with required server roles. to this - inside monitoring console go to settings > General Setup > Distributed
... View more
08-12-2019
02:25 AM
Hi . you can. This is called as splunk migration.
1) stop stop splun from host you want to migrate to.
2) tar/zip splunk home
3) copy the entire tar/zip of old host to new host.
4 ) untar the zip
5) start splunk
... View more
08-12-2019
02:19 AM
Hi . you can. This is called as splunk migration.
1) stop stop splun from host you want to migrate to.
2) tar/zip splunk home
3) copy the entire tar/zip of old host to new host.
4 ) untar the zip
5) start splunk
... View more
08-11-2019
10:06 PM
I cannot see this job in splunk as well. I tired to search in jobs with the ID, no job is queued. Please help me to remove this message.
... View more
10-10-2018
01:44 AM
@harsmarvania57 : can I get the list of all the GUID on license master ( list of all the servers who are reporting to license master )
I dont want to login to each server are get their guid, as this is not possible to automate
... View more
10-10-2018
01:16 AM
1 Karma
I tried running this command, but no slave gets added in server.conf.
/opt/splunk/bin/splunk add licenser-pools pool_name -quota 10gb -slaves slave1,slave2 -stack_id enterprise
The below pool stanza gets added without slave servers:
[lmpool:pool_name]
quota = 10gb
stack_id = enterprise.
When I add the indexers in the pool from the console, I see something like this below:
[lmpool:test]
quota = 2147483648
slaves = C95CC0BB-CFEA-4D2A-A1A9-0FB12382FSCW,6386358F-1564-4F46-A961-35875BFB58F8
stack_id = enterprise
Also, how do I directly edit server.conf? How does this value generating exactly ? slaves = C95CC0BB-CFEA-4D2A-A1A9-0FB12382FSCW ---- this is server name , but not sure what it means to Splunk.
How do I get these added via CLI or updating server.conf ?
... View more
07-11-2018
01:33 AM
I followed the following steps:
1) stop first cluster master
2) change master_uri from old ip address to new ip address in server.conf of indexers and search head.
3) Install new instance of different server
3) copy [general] , [clustering] , [sslConfig] from old cluster master to new splunk instance
4) start new splunk instance
When I did this , I am unable to login to console . I can hit https://:8000 , but when I give my credentials it gives 500 error..
500 Internal Server Error
Oops.
Click here to return to Splunk homepage.
Also cli commands like ./splunk help cluster-bundle are not giving any response .
Is anyone aware what might have went wrong?
... View more
- Tags:
- splunk-enterprise
07-10-2018
07:17 AM
index="bla" | stats last(_raw)
and
index="bla" | tail 1
both of them worked...
... View more
07-10-2018
06:54 AM
what is splunk search query to find the oldest ( first ) event generated on a index ?
... View more
06-27-2018
12:10 AM
I am new to splunk , need this to setup my cluster . I want to understand search head and what required in search head
... View more
06-15-2018
01:17 AM
I guess below two files as well,
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/dmc_forwarder_assets.csv
... View more
06-15-2018
01:16 AM
Hello,
is anyone aware how to configure monitoring console via cli command ( not updating the .conf files )
there are many files to update in conf which is not feasible . I found below files need to be updated , hope I did not miss any.
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/dmc_forwarder_assets.csv
/opt/splunk/etc/apps/splunk_monitoring_console/local/splunk_monitoring_console_assets.conf
/opt/splunk/etc/system/local/distsearch.conf
... View more
05-23-2018
09:30 PM
thank you for the links.
just want to check , if I have configured deployer , will I be able to restart my search head server from deployer server ?
Also if the deployer is configured correctly , I should be able to see the search head cluster status from deployer server ( when I run ./splunk show shcluster-status ) . at the moment it is now showing cluster status
Or is it that I need to study more in Splunk?
Thank you
Mayur
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
