Can enable skewing or schedule a bash script that spawns particular search requests every second. ... View more

To have perfect run intervals, a user can append ampersand (&) before every such sleep command. ... View more

Crazy. I'd like to highlight another spot in official documentation confirming that roles' settings are imported: (v 7.1.2) https://docs.splunk.com/Documentation/Splunk/latest/Admin/Authorizeconf srchTimeWin = * Maximum time span of a search, in seconds. * This time window limit is applied backwards from the latest time specified in a search. * By default, searches are not limited to any specific time window. * To override any search time windows from imported roles, set this to '0' (infinite), as the 'admin' role does. * -1 is a special value that implies no search window has been set for this role * This is equivalent to not setting srchTimeWin at all, which means it can be easily overridden by an imported role Also, in my Splunk, "User-level concurrent search jobs limit" is successfully inherited from parent role, tested. ... View more

Are our ufix events considered by server to be erroneously indicated as CSV type? Is it a problem caused by unquoted space chars or something? Sample ufix event: "/opt/splunk/var/lib/splunk/xru/db/db_1531217904_1531166719_2035/rawdata","journal.gz",10.07.18 13:18 ,453815577,0,6E09087F,3,- Sample ufix_status event: List creation: 0, prj creation: 0, report creation: 0 splunk/etc/apps/x/local/props.conf: [ufix] DATETIME_CONFIG = CURRENT FIELD_NAMES = directory, filename, date, byte_length, line_length, crc, crc_type, id_crc INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = CSV-report by ФИКС-Unix disabled = false pulldown_type = true [ufix_status] category = Structured pulldown_type = 1 EXTRACT-list_status = List creation: (?\d*), prj EXTRACT-prj_status = prj creation: (?\d*), EXTRACT-report_status = report creation: (?\d*) DATETIME_CONFIG = CURRENT FIELD_NAMES = directory, filename, modify_date, byte_length, line_length, crc, crc_type, id_crc INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false ... View more

Checked that INDEXED_EXTRACTIONS setting is not being redefined several times in any configs. There are no INDEXED_EXTRACTIONS settings in our server config except for ufix, ufix_status and default config files (unchanged). ufix and ufix_status events are generated every morning, the should not be causing the minutely error messages. ... View more

I am fixing a production Splunk with lots of inputs and users, so I cannot just 'start over' a fresh server and find out when the error would reappear again. Please advise. How can I track down the input causing the error? How can I know what is the impact of the error? What is the best practice to fix it in a proper way? What is the meaning of this error at all? ... View more

Can you please advise, what do I do if my Splunk (v7.0.2) complains a lot in splunkd.log about 05-21-2018 14:01:18.641 +0300 ERROR IndexedExtractionsConfig - Tried to set INDEXED_EXTRACTIONS but it already had a value! (was: 0, wanted: 😎 I have tried enabling debug logging level for IndexedExtractionsConfig, but got no details. Unfortunately I cannot just restart this server in full debug logging mode (part of a production environment). ... View more

Please advise, is it a safe procedure to copy huge cold buckets to the target partition first, then make indexes.conf change, then perform a quick splunk restart and delete old colddb? ... View more

It's an issue indeed. When we append some digits to avoid collisions, we must choose a big number (eg. 1000), but there indeed is a limit, and the bucket dirs beyond that limit are not included in .bucketManifest and not sought. And there is even no warning in logs. ... View more

And the bucket number should really only contain digits, no literals, and field length is limited. ... View more