Firstly, let me point out that you're digging up a very old thread. You'd get better chance of reasonable (i.e. not mine ;)) answer if you created a new question and optionally provided a link to the old one for reference. But to the point. I suppose there are several scenarios that can happen during an attempt to roll and accounting for all of them and handling them could be: 1) hard to do 2) not necessarily desired in some situations. Imagine a cluster with RF=1. If you stop rolling buckets you're on the best path to filling up the storage and rendering the indexer inoperable. But if you can find a good use case for some particular behaviour that could be implemented in the maintenance thread, feel free to open an idea with https://ideas.splunk.com/ ... View more

SoS unfortunatly does not show much else for our universal forwarder. The most I could conclude from SoS was that file descriptor and memory usage are within acceptable limits and that CPU usage is at 100%. It also provided me with the information, that the TailingProcessor was reporting errors which was a good starting point. After using system profiling tools I found out however that out of 24 threads of splunkd running only one of them is constantly at 100%. Further digging led me to a stanza that was causing errors for the TailingProcessor. It was not the stanza itself but rather the data that was being monitored. Temporary files were being created then removed in a certain spool folder and it seems that this was causing problems for the UFW. After blacklisting the said spool folder load dropped to almost zero and it is staying there for now. ... View more

Looks like to some extent, different releases don't have an issue with this procedure. I've done this while upgrading from 5.0.2 to 5.0.4 (32bit only) for .tgz based installation without any noticeable issue. ... View more

Interestingly enough we didn't have an issue with the Splunk TA for Linux and Windows shipping out with the Nav bar shared globally UNTIL we attempted to change the permissions of the Nav bar in one of the apps. This created a couple lines in the local.meta file specific to the app level permissions to this object but somehow wasn't handled gracefully by Splunk (aka the globally shared nav bar permissions appeared to kick in ala exambra_splunk's post) ... View more

To expand on what Kristian posted try running this search index=_internal sourcetype=splunkd "current data throughput" | rex "Current data throughput \((?<kb>\S+)" | eval rate=case(kb < 500, "256", kb > 499 AND kb < 520, "512", kb > 520 AND kb < 770 ,"768", kb>771 AND kb<1210, "1024", 1=1, ">1024") | stats count as Count sparkline as Trend by host, rate | where Count > 4 | rename rate as "Throughput rate(kb)" | sort -"Throughput rate(kb)",-Count It is one I baked into the app Forwarder Health ... View more

Hi, You will need to create/edit the following files in $SPLUNK_HOME/etc/apps/<appName>/local/ : props.conf transforms.conf NOTE: the following is just an example and should be modified to meet your requirements, using the relevant spec files for assistance: props.conf: [yourSourceTypeHere] TRANSFORM-hostnametrans = newHostTrans transforms.conf: [newHostTrans] REGEX = \w+\s+\d+\s+\d+\:\d+\:\d+\s+(?P<host>[^ ]) FORMAT = host::$1 DEST_KEY = MetaData:Host You will need to restart Splunk to apply this change. The following docs should be of use here... http://docs.splunk.com/Documentation/Splunk/5.0/Data/overridedefaulthostassignments http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf http://docs.splunk.com/Documentation/Splunk/5.0/admin/Transformsconf ... View more

Your answer filled in the missing pieces of the puzzle. No confusion added 🙂 ... View more