About mlindsey

rbal_splunk · ‎06-10-2015

You are on Search Head Cluster and the behavior described here has been identified as Splunk Bug # SPL-98917/ SPL-99099:[SHPNEXT] to figure out a way to migrate private user assets into a search head cluster such that they can be deleted, moved, shared, etc This Bug is expected to be fixed in Splunk release 6.2.4, in the mean time please log a Support Case an Support has script to fix this issue.

mlindsey · ‎06-07-2014

The following worked just great! Kudos to James Brodsky and Splunk Support. In props.conf: # This stanza drops alls events destined for the 'development' index. # [host::*] TRANSFORMS-dropindex = senddevidxtonull In transforms.conf: [senddevidxtonull] SOURCE_KEY=_MetaData:Index REGEX=development DEST_KEY=queue FORMAT=nullQueue

hsesterhenn_spl · ‎07-22-2016

An other idea... ulimits? https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements#Considerations_regarding_file_descriptor_limits_.28FDs.29_on_.2Anix_systems HTH, Holger

Posts	5
Solutions	1
Karma Given	1
Karma Received	5
Member Since	‎01-27-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Promoting an app from private visibility to app vi...

How to drop all entries to a specific index?

Intermediate forwarder connections timeout

Re: Promoting an app from private visibility to ap...

Re: How to drop all entries to a specific index?

Re: Intermediate forwarder connections timeout

Join the Conversation