thankyou. it worked  ... View more

@mintughosh Can you please share the steps or the tips on how you resolved it. As I am facing the same concern where, I do not get any event results when i run a SPL with host= . Not sure if this is something to do with roles. Thanks. @niketn  FYI ... View more

Hi All,   Hope this will help after this long time 🙂 One of my team members found an easier approach to adjust lookup tables from the SHC side; he discovered a GUI application that would reflect the changes to the search members, and to modify the lookup from the SHC deployer, one may apply from the CLI without restarting. ... View more

@woodcock I am having the same issue only difference is when my UF attempts again after a few minutes HandShake is achieved and all the applicable apps are pulled down.  This same pattern is happening across a significant number of endpoints.  Any idea why that would be the case?  ... View more

You can run from the Monitoring Console (splunk_monitoring_console app context)  to check THP effective state: | rest /services/server/sysinfo splunk_server_group=dmc_group_indexer | table splunk_server version numberOfCores, numberOfVirtualCores physicalMemoryMB ulimits.open_files transparent_hugepages.effective_state | sort +splunk_server ... View more

even i am facing similar issue and dont see any file in "$SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/local/data/threat_intel" ... View more

Thanks for your answer. This will help, when we want to check the current status of throttled values. But what I forgot to mention is that I also want to see a historic status of no longer throttled values. My real use case was to understand why an alert fired for some, but not all expected results. And at a time where the throttling was already outdated.  Your approach is very nice, but cumbersome to use in daily business, as there is no direct way to get information about the status of throttling. (Need of hashing values to look up in throttling CSV files) Nevertheless I learned some new stuff. Thank you for that. 🙂 As a possible workaround, for this information not to be directly accessible in Splunk, I got a hint to use the alert action Log Event to write the desired  information into an index.  ... View more

Does "index=notable" show results?  If so does the search `notable` show results?  If so are you using notable event suppressions?   If index=notable does not show data, then it sounds like you did not generate notable events At the end of the day, index=notable feed IR page.  And Correlation searches feed index=notable ... View more

1. This dashboard is fed by a KV Store Collection called "ess_notable_events" 2. The "ess_notable_events collection is fed by a Scheduled Search called " ESS - Notable Events" 3. In order for searches to be run from a SH, the indexing tier must have a "Common Knowledge Bundle" installed on ALL indexers.  If you don't have a common baseline across all indexers the scheduler on the SH will quit running searches. To me it sounds like you have some issues between your ES SH and your indexing tier, and I would start here for the trouble shooting process.  a. How big is your bundle on the SH in /opt/splunk/var/run/ *.bundle b. Is your ES SH on the same network as your Indexers?  c. Are you system running with plenty of resources and no network connectivity issues between them. d. you can increase settings like timeouts between the SH and indexers for 8089 communications, but if you are having to do this on a small splunk setup, then something above might be causing your issues. e. are these physical systems or are you running on an over-subscribed virtualized hardware?   Lot of things to look at here, and most all of these are addressable.  If you need further help you might start with a support ticket to help you diagnose the issue . ... View more

Does Splunk officially support for installing 2 UFs for Linux Machines?? I know it doesn't for windows.   ... View more

What version of ES / Core are you running? There should be no reason to slow down the identitiy_manager modular input. ... View more

https://answers.splunk.com/answers/326863/kvstore-initialization.html is related to the permissions issue with splunk.key ... View more

Search heads are a very basic concept of Splunk that every Splunk admin must understand. What specific part of my answer confuses you? ... View more

Your earlier H/W resources were less than the minimum requirements for ES. I think even after adding the ess_admin role, it wouldn't have worked. https://docs.splunk.com/Documentation/ES/6.1.1/Install/DeploymentPlanning ... View more

Sorry still my problem not solved. Still the "threat activity detected" is triggering against custom uploaded csv file. However when I give below command and there is no data against that feed. | inputlookup ip_intel | search threat_key="abc" and under threat activity dashboard I can see that the custom csv upload threat feed is still ative against most active threat sources ... View more

Thanks a lot for your response. ... View more

thanks, Okie! ... View more

you can disable kvstore on your indexers...... don't delete the directory..... although I guess the one in /opt/splunk/var/lib/splunk would be okay, but the other one in your new SPLUNK_DB will most likely get re-created all the time.. The flat file dumps are in var/run/searchpeers in the bundles that are sent over. ... View more

http://docs.splunk.com/Documentation/Splunk/6.2.13/Installation/HowtoupgradeSplunk ... View more

You will need to click on Apply Change for its state to change from New to Configured. ... View more

We are tracking several known causes for lookups not being replicated from SH->Indexer. If app is disabled. See app.conf If lookup is a kvstore collection and replicate is set to false. See collections.conf If lookup has been blacklisted from replication (applies to both csv and kvstore collections). See distsearch.conf. If distributed search is disabled (often seen in environments that upgraded to index clustering). See distsearch.conf. David ... View more

Thanks Rich for your search. This search helped me in reducing the time in doing the testing.. ... View more