Just as a follow up with csv I definitely get an error. I get the error: Non-result: ERROR The lookup table 'not_really_my_lookup_name.csv' requires a .csv or KV store lookup definition.. Without .csv I get the same error but *also*: Non-result: ERROR The lookup table 'not_really_my_lookup_name' is invalid.. ... View more

Does this mean you did or didn't manage to auth to a non-local account in the end? (I'm thinking not?)   Cheers, Barry ... View more

Hi @roopendra,   Could you please let me know the steps which you have followed to implement Bamboo build stats into splunk? It will be helpful for me as I am working on that. Regards, Neha   ... View more

Just to link the topics... If you are running Splunk Enterprise in an environment where the difference between physical CPUs and virtual CPUs/threads is visible for SplunkD (e.g. bare metal, AWS, GCP, etc) you will see a higher "virtual" number which will be taken into account by the Splunk-internal engines.  See limits.conf.  If you are in a VMware environment and you see physical CPU=virtual CPU, you need to double the vCPU count in your VMware instance settings  to get the same performance because otherwise SplunkD will use less resources.  https://community.splunk.com/t5/Archive/How-does-Splunk-handle-Hyperthreading-in-a-VMware-environment/m-p/424582/highlight/true#M75311 ... View more

Final update and one massive caveat that I haven't had a chance to fully investigate. This setup works brilliantly except if you have a DNS failure. We had a failure of the primary DNS server and this meant that name resolution on the system was a crapshoot (possibly due to shitstemd name resolution) - this made the fusemounts unusable (need to raise with MS - filesystem operations DO NOT timeout), and exposed a bug in Splunk, (Splunk relies on the underlying filesystem to timeout, and if it doesn't neither will Splunk), which meant Splunk would hang coming up as it attempted to access frozen storage (but there were no logs to indicate this). ... View more

Correction: auth_type doesn't get set, it's derived from the provided params. The correct parameters for username and password are taxii_username and taxii_password ... View more

We are seeing high write quantities (over 2gb) that don't equate to our source input. We are on a 1TB drive (5000 IOPS), 8 core, 16gb ram F8Sv2. The blob storage container we have as input may add 5-8 thousand files over a weekend, but these are tiny log files -- 10k each. I fear, as suggested above, that it is looking at all files and appending the deltas / new files. Any suggestions on how we can mitigate further? (previous upgrades to vm has had no affect and MS has assured us all is well on their disk backend). ... View more