Hi Team, i have changed my license key from 40GB to 65GB, but this search: index = __internal metrics kb group="per_index_thruput" series!=_* | eval totalGB = (kb / 1024) / 1024 | timechart span=1d sum(totalGB) as total is still referring to 40GB and giving the wrong result. can you please tell me what do i need to change to get the correct volume usage for 65GB? Thanks, Seema ... View more

Hi Team, currently volume used is 24.458MB Pools Indexers Volume used today auto_generated_pool_enterprise * 24,458 MB / 66,560 MB Edit | Delete eeukrp0035 24,458 MB (36.745%) but the search i am using isn't giving the correct output :- index=_internal metrics kb group="per_index_thruput" series!=_* | eval totalGB = (kb / 1024) / 1024 | timechart span=1d sum(totalGB) as total Can you please help me to get the exact search that will generate the correct output? Thanks, Seema ... View more

Hi Team, I was having 100GB of Splunk 4.1.2 version, I wanted to divide it into two parts 75GB and 25GB, i have received the license key in XML format. I am trying to copy the signature tag content as a license key while installing new license key of 75GB in 4.1.2 version of Splunk I am getting below errors:- UnboundLocalError : local variable "Call to Action " reference before assignment Please help me to sort this. Thanks, Seema ... View more

Hi Team, We are getting "License warning issued within past 24 hours (Tue Jan 13 00:00:00 2015 GMT). See License Manager for details." To fix this issue we thought of increasing the indexing volume limit but for that we need storage capacity. how to check the storage capacity ? Please suggest on it. Thanks, Seema ... View more

Hi Splunkers, I have lost permissions to read the metrics logs. I have asked the platform team and they have updated me with the message: "We changed permissions manually on affected file to splunk:splunk metrics.log also on metrics.log.1 and metrics.log.2. We cannot confirm, after next rotate correct permission, because rotation mentioned "metrics" fields is not under OS management but under APP. Please check settings of rotation from your side." Please advise where I need to change the settings to get the permission permanently. Thanks, Seema ... View more

Hi, can we create user with Splunk Rest APIs access. Thanks, Seema ... View more

Hi Team, Where are the forwarded logs being saved in the indexer after getting indexed? As i know this is very known issue but still i did not get my answer for it. in general, indexes.conf contain below details :- Cold $SPLUNK_HOME/var/lib/splunk/defaultdb/colddb/* Hot $SPLUNK_HOME/var/lib/splunk/defaultdb/db/* Thawed $SPLUNK_HOME/var/lib/splunk/defaultdb/thaweddb/* But as per my indexes.conf file i can able to see :- coldPath = $SPLUNK_DB/audit/colddb homePath = $SPLUNK_DB/audit/db thawedPath = $SPLUNK_DB/audit/thaweddb so here is the confusion in the path, it should be $SPLUNK_HOME or $SPLUNK_DB ? if it is $SPLUNK_HOME then please find the below details cause $SPLUNK_HOME= /opt/product/splunk :- bash-3.2$ pwd /opt/product/splunk/var/lib/splunk bash-3.2$ ls -lrt total 44 drwx------ 5 XYZ XYZ 4096 Jul 2 2012 summarydb drwx------ 5 XYZ XYZ 4096 Jul 2 2012 _internaldb drwx------ 5 XYZ XYZ 4096 Jul 2 2012 historydb drwx------ 2 XYZ XYZ 4096 Jul 2 2012 hashDb drwx------ 5 XYZ XYZ 4096 Jul 2 2012 defaultdb drwx------ 5 XYZ XYZ 4096 Jul 2 2012 blockSignature drwx------ 2 XYZ XYZ 4096 Jul 2 2012 authDb drwx------ 5 XYZ XYZ 4096 Jul 2 2012 audit drwx--x--- 4 XYZ XYZ 4096 Jul 2 2012 appserver drwx------ 2 XYZ XYZ 4096 Jul 2 2012 persistentstorage drwx------ 7 XYZ XYZ 4096 Jul 3 2012 fishbucket and i am not able to see the forwarded logs over here. or if it is $SPLUNK_DB then where can i see the full path of it? Thanks, Seema ... View more

Hi Team, Tivoli is an event management tool, we have configured custom mail alerts in the Splunk right now. Instead of mail alerts, the alerts needs to be shared with Tivoli then Tivoli will generate P3/P4/etc. incidents. Please suggest, can it be possible in splunk. Thanks, Seema ... View more

Dear Splunkers, I have two forwarders running in my Splunk setup and they are transferring data at a rate of 256 KBPS, which is as per the transfer rate setup in LIMITS.conf. However this is not serving my purpose, as I can see a delay in the logs being indexed (at least 4 -5 hours). Could you please advice if you have encountered similar issue and what solution could probably fix it, i did some research of my own from past few days and found that by abruptly increasing the maxKBps = 0 or maxKBps = xxxx, it might result in blocked queues in indexer and forwarder too. Any idea how to get around this ? Will really appreciate any pointer to solve this issue. thanks in advance! Thanks, Seema ... View more